Developer Tools
Should you commit go.work to version control?
The Go modules reference calls committing go.work generally inadvisable. Here is why, the one case where it makes sense, and what to do in CI instead.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Should pull requests disclose AI assisted code? A decision guide
Whether to ask authors to flag AI assisted code in pull requests: reasons for and against, a light template, and how reviewers should use the note.
Oct 18, 20263 min read
Developer Tools
Should I upgrade a dependency to a new major version?
Major versions may break your code, so upgrade for a reason: a security fix, end of support, or a feature you need. Here is a simple way to decide and test.
Oct 18, 20263 min read
Developer Tools
Should your application code ever see a raw encryption key?
OWASP says application code should not read or handle raw keys. How to design so a vault or KMS performs the operation and your app never holds the key.
Oct 18, 20264 min read
Developer Tools
Should an AI review count as a required approval on a pull request?
Should a bot's approval satisfy branch protection? A decision guide using GitHub's required review, stale approval and code owner settings, with tradeoffs.
Oct 18, 20263 min read
Developer Tools
Share Git hooks with your team using core.hooksPath
The default hooks folder is not tracked by Git. Setting core.hooksPath to a folder in the repo lets a team share hooks, with caveats you should know first.
Oct 18, 20264 min read
Developer Tools
SFT vs DPO vs reinforcement fine-tuning: what each is for
Supervised, preference and reinforcement fine-tuning solve different problems. A short guide to which method matches your data and your goal.
Oct 18, 20263 min read
Developer Tools
Set LLM API spend limits, and know what happens when you hit them
Spend limits stop a runaway bill, but they also stop production. See the limit types, the error each one returns, and how to plan a degraded mode for both.
Oct 18, 20263 min read
Developer Tools
Send Safeguard CLI detect results to GitHub code scanning with SARIF
Run the Safeguard CLI detect command in GitHub Actions, write SARIF, and upload it so findings appear in the repository's code scanning view.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.