Developer Tools
Why SARIF support matters when you choose a code scanner
SARIF is the standard JSON format for static analysis results. What it contains, why it reduces lock-in, and how to test a tool's export in a pilot.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Why SSH sessions drop on mobile networks and what to set
SSH sessions die when you change networks or sit idle. Learn what ClientAliveInterval does, why dead sessions linger, and how to set it safely.
Oct 18, 20264 min read
Developer Tools
Will AI generated tests fail when the code breaks? A quick audit
AI can write tests that pass today and prove nothing. A quick audit to check whether generated tests actually fail when the code under test is broken.
Oct 18, 20263 min read
Developer Tools
How to write a secure coding lab exercise that actually teaches
A good lab has one bug class, a clear exploit, an editable fix and a test that proves it. Here is a template for writing your own secure coding exercises.
Oct 18, 20263 min read
Developer Tools
How to write a SECURITY.md that researchers can actually use
A good SECURITY.md tells reporters where to send findings and what to expect. Here is a template, what GitHub asks for, and what Scorecard checks.
Oct 18, 20263 min read
Developer Tools
Write the security review rubric before you write the prompt
Define a good LLM security review first: checks, severity rules, and an answer key from past findings. Then your prompt has something to be tested against.
Oct 18, 20263 min read
Developer Tools
Write evals before you fine-tune: a practical starting guide
Build a small eval set from real inputs before changing prompts or training a model. Learn how to size it, score it, and avoid fooling yourself.
Oct 18, 20263 min read
Developer Tools
How to write unit tests for Rego policies with opa test
Policy as code needs tests. How to write Rego test rules, mock input with the with keyword, check coverage and avoid silently empty test runs in CI.
Oct 18, 20263 min read
Developer Tools
The Year 2038 problem: a developer guide to 32-bit time
On 19 January 2038, signed 32-bit Unix time overflows. Here is what can break, which fixes exist, and how to check your code, databases and devices today.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.