Developer Tools
Which developers should join an AI coding agent pilot first?
Pick six to ten experienced developers across different kinds of work, plus one skeptic and one reviewer. Here is how to choose and who to leave out.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Which developer tooling can Dependabot update for you?
Dependabot version updates cover more than libraries: GitHub Actions, Docker, dev containers and pre-commit hooks. See what to enable first for tooling.
Oct 19, 20263 min read
Developer Tools
Which dependency scan should a small team add first?
A small team with no dependency scanning should start with a pull request check on lock files, then add scheduled re-scans. Here is the reasoning.
Oct 19, 20264 min read
Developer Tools
Which CycloneDX version should your build emit?
Pick the CycloneDX schema version your consumers can read, not the newest one. Here is how the Maven, Gradle and npm generators handle the setting.
Oct 19, 20264 min read
Developer Tools
Which Bazel lockfile mode should CI use: update or error?
Bazel's lockfile_mode flag has four settings. Use error in CI so a changed dependency graph fails the build instead of silently rewriting the lockfile.
Oct 19, 20264 min read
Developer Tools
How do you find which apps still use an old design system version?
Read each app's lockfile for the library version, publish the list as an adoption table, and set a deadline. A short routine for design system owners.
Oct 19, 20264 min read
Developer Tools
Which Apple upload requirements can an old SDK break?
Xcode 26 builds, iOS 13 minimum target, required reason APIs and SDK privacy manifests: the Apple upload rules where an outdated SDK can block your release.
Oct 19, 20263 min read
Developer Tools
Where should you set pip's index-url to enforce an internal mirror?
pip reads global, user and site config, then PIP_CONFIG_FILE, then env vars and flags. Where to set index-url, and what can override it in practice.
Oct 19, 20263 min read
Developer Tools
Where should dependency scans run in a monorepo?
In a monorepo, scan per project on the pull request using path filters, and scan the whole repository on a schedule. Here is how to split the work.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.