Developer Tools
How do you announce new security tooling to developers?
Tell developers what changes, what does not, how to get help and when blocking starts. A rollout message template and a simple timeline to copy.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
How do I add an analyzer to every .NET project at once?
GlobalPackageReference in Directory.Packages.props applies a build tool or analyzer to every project as a development only dependency. Here are the steps.
Oct 18, 20263 min read
Developer Tools
How should you tag release container images? Rules and a scheme
OCI tags allow 128 characters from a fixed set. A tagging scheme with version, commit SHA and digest that stays traceable and safe to promote.
Oct 18, 20263 min read
Developer Tools
How should you set requires-python for a Python library?
Set requires-python to the oldest Python you test, add no upper cap, and know how pip uses it to pick older releases. Syntax examples and common mistakes.
Oct 18, 20264 min read
Developer Tools
How does OWASP Dependency-Check decide a library is vulnerable?
Dependency-Check gathers evidence about each dependency, infers a CPE, then lists matching CVEs. What that means for accuracy, data sources and updates.
Oct 18, 20263 min read
Developer Tools
How old can the Chromium inside your Electron app safely be?
Electron supports the latest three stable majors on an 8 week cadence. What that means for the Chromium your app ships and how to plan upgrades.
Oct 18, 20263 min read
Developer Tools
How often should you update dependencies? A practical cadence
Update on a schedule, fast for security fixes and steadily for the rest. Here is a cadence that keeps upgrades small without flooding your team.
Oct 18, 20263 min read
Developer Tools
How often should you scan open source licenses?
Scan licenses on every pull request, on a schedule for the whole portfolio, and at release. Each trigger catches a different problem, so use all three.
Oct 18, 20263 min read
Developer Tools
How many security comments on a pull request is too many?
Cap scanner comments per pull request, show only new findings on changed lines, and keep the rest in a summary. A developer friendly comment policy.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.