Developer Tools
A security checklist for Firefox extension developers
Mozilla's secure extension guidance as a checklist: remote code, DOM insertion, CSP, wrappedJSObject, UI, fingerprinting and third-party libraries.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Fine-tuning vs RAG: a decision guide for adding knowledge
Use retrieval for facts that change and fine-tuning for behaviour and format. A decision guide with questions to ask and when to combine both.
Oct 18, 20263 min read
Developer Tools
Fine-tuning FAQ: short answers to common questions
Quick answers on fine-tuning LLMs: data size, cost, LoRA, RAG, safety, forgetting and evals, each with a link to the longer guide for more detail.
Oct 18, 20263 min read
Developer Tools
Fine-tuning data preparation checklist: 12 checks before training
A twelve point checklist for fine-tuning data: sourcing, cleaning, labelling, splitting, privacy and provenance, to run before you spend on training.
Oct 18, 20263 min read
Developer Tools
How to find quantum-vulnerable cryptography in your codebase
A practical search plan for RSA, ECDSA, ECDH and X25519 usage across source, config, certificates and dependencies, before a post-quantum migration.
Oct 18, 20263 min read
Developer Tools
FHIR AuditEvent vs Provenance: which one to use
AuditEvent records that something happened and who did it. Provenance records how a resource came to be. When to use each, and keeping audit honest.
Oct 18, 20263 min read
Developer Tools
Four feature flag types and how long each should live
Release, experiment, ops and permissioning flags have very different lifetimes. Knowing which one you have tells you when it should be removed.
Oct 18, 20263 min read
Developer Tools
Feature flag debt: why every flag needs an expiry date
Old feature flags hide dead code, untested paths and forgotten access rules. How to inventory, expire and remove flags before they become a risk.
Oct 18, 20264 min read
Developer Tools
Fail a CI build on critical findings with the Safeguard CLI and jq
The scan command reports but does not fail the build. A short jq step on the output file adds a severity gate you control, with a note on exit code 2.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.