Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Use a concurrency group so only one scan runs at a time, then choose whether to replace pending runs, cancel running ones or queue them up in order.
Precision is how many flags are real, recall is how many real issues it finds. Favour one or the other depending on where the reviewer sits in your flow.
A policy states the rule, a gate checks it at a point in the pipeline, and a guardrail limits what a tool can do. How the three work together for AI code.
The ~> operator allows updates within a range, and :git sources skip the registry. Learn what each lets in and how to keep Podfile choices reviewable.
pod install honours Podfile.lock, pod update ignores it. Learn which to run in CI, which to run by hand, and why the difference matters for security.
A PodDisruptionBudget limits voluntary evictions during node patching. When a vendor chart should include one, with values by workload type.
A pnpm workspace keeps one pnpm-lock.yaml at the root by default. Learn what that means for scan scope, per-package results and the per-project option.
pnpm blocks dependency build scripts until you approve them. Learn what strictDepBuilds does, how to approve by name, and why to avoid allowing all builds.
pnpm holds dependency build scripts until you approve them. Learn allowBuilds, strictDepBuilds, the v11 change to onlyBuiltDependencies, and what to skip.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
