Developer Tools
Snapshot tests fail after a security bump: update or investigate?
A snapshot test fails after a dependency fix. Read the diff first: update the snapshot only when the change is intended, harmless and explained.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
What should a smoke test check after a dependency upgrade?
A smoke test after a dependency upgrade proves the app starts and its critical paths work. What to include, what to leave out, and how long it should take.
Oct 19, 20264 min read
Developer Tools
How can you slim a container image using its SBOM?
Read the image SBOM to spot build tools, shells and packages you do not need at runtime, then use multi-stage builds to leave them behind safely.
Oct 19, 20263 min read
Developer Tools
Is skops a safer way than pickle to save scikit-learn models?
skops saves scikit-learn models without pickle and has you review untrusted types first. What it improves, what it cannot do, and how to adopt it.
Oct 19, 20264 min read
Developer Tools
Why does SignTool warn about /fd and /td, and what should you set?
Recent SignTool builds require /fd for the file digest and /td for the timestamp digest. Set both to SHA256, use /tr for RFC 3161, and check exit code 2.
Oct 19, 20264 min read
Developer Tools
Signed commits and required checks: what they prove, and what they don't
Signed commits show who pushed, and required checks show tests passed. Neither proves the code is safe. Here is what each control does and misses.
Oct 19, 20264 min read
Developer Tools
Why should a security finding show the fix, not just the problem?
A finding that includes the fix gets acted on faster. What a good fix suggestion contains, when to offer a pull request, and when a human must decide.
Oct 19, 20264 min read
Developer Tools
Should your team run an internal Homebrew tap for developer tools?
An internal tap gives developers one install path, and tap code runs with the user's privileges. Homebrew's tap trust model shapes how to run one safely.
Oct 19, 20264 min read
Developer Tools
Should a device companion app force a minimum version?
A minimum supported app version lets you retire a vulnerable release of your companion app. Here is how to set it up without locking customers out.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.