Developer Tools
Questions to ask a vendor about reachability analysis claims
Reachability analysis can cut noise, but claims vary. Ask what it analyses, which languages, how it handles dynamic code, and how to verify it.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
What should you ask before embedding a partner's SDK in your product?
An SDK runs inside your app with your permissions. Ten questions on data, dependencies, updates and exit to ask before you integrate a partner's code.
Oct 18, 20263 min read
Developer Tools
What do ~=, == and >= mean in a Python requirement?
A plain guide to Python version specifiers: what compatible release, exact match and minimum version allow, and which one to use in a project you ship.
Oct 18, 20264 min read
Developer Tools
What do Python bugfix and security support phases mean?
Each Python version gets about two years of bugfix releases, then security only fixes until five years after release. Dates for 3.11 to 3.15 inside.
Oct 18, 20263 min read
Developer Tools
What do pip and PyPI do with pre-release and local version numbers?
Pip skips alpha, beta, rc and dev versions unless asked, and PyPI rejects versions with a plus suffix. How to publish a safe test release for your library.
Oct 18, 20264 min read
Developer Tools
Should you use a post release or a new patch version for a fix?
A .postN release is for mistakes that do not change the software, such as release notes. Bug fixes belong in a new patch version. Examples and how pip orders them.
Oct 18, 20264 min read
Developer Tools
How should a Python package declare its license (PEP 639)?
Use the License-Expression field with a valid SPDX expression and list files with License-File. The old License field and classifiers are deprecated.
Oct 18, 20263 min read
Developer Tools
Requirements or constraints file: which one should a scan read?
A pip constraints file limits versions but installs nothing. Learn which Python files describe what you ship in a monorepo and which a scanner should read.
Oct 18, 20263 min read
Developer Tools
Python extras or dependency groups: what is the difference?
Extras ship with a package and users can install them. Dependency groups stay in your repo for tests and docs. See how each works and which to choose.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.