Developer Tools
How do you link an SBOM to the CI build that produced it?
Add a build reference to each SBOM so readers can trace it to the exact CI job. The CycloneDX Gradle plugin detects several CI systems for you.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Should you set the tsconfig types option in a Node project?
The tsconfig types option controls which @types packages become globals. Why listing them explicitly keeps a Node service's type surface small and clear.
Oct 19, 20263 min read
Developer Tools
Library upgrade changed your log output: check PII and alert rules
A dependency fix can change what your logs contain and how they are formatted. How to check for leaked data and broken alert and parsing rules.
Oct 19, 20264 min read
Developer Tools
Should an AI assistant add a library or write a ten line helper?
A decision guide for the moment an AI assistant reaches for a new package. When a small helper is safer, and when a maintained library is the better call.
Oct 19, 20264 min read
Developer Tools
A library fix now throws new errors: test your error handling
Security fixes often turn silent acceptance into errors. How to find the new exceptions, handle them safely and avoid crashes or leaked details.
Oct 19, 20264 min read
Developer Tools
How do you shrink a fuzzing corpus without losing coverage?
Use libFuzzer's merge mode into an empty directory. It keeps inputs that add new coverage and drops the rest. Keep crash regressions in a separate folder.
Oct 19, 20264 min read
Developer Tools
Let's Encrypt stopped expiry emails: what should you monitor now?
Let's Encrypt ended expiration notification emails on 4 June 2025. Here is how to monitor certificate expiry yourself and which thresholds to alert on.
Oct 19, 20264 min read
Developer Tools
Which Let's Encrypt profile to pick: classic, tlsserver, shortlived?
Let's Encrypt ACME profiles compared: what classic, tlsserver and shortlived change in lifetime, names and validation, and who should pick which.
Oct 19, 20264 min read
Developer Tools
Why did Let's Encrypt pause issuance for my domain, and how to unpause?
Let's Encrypt can pause new certificates after many consecutive failed validations. See how the pause works, how to unpause, and how to fix the cause.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.