build-security
Safeguard articles tagged "build-security" — guides, analysis, and best practices for software supply chain and application security.
37 articles
Build Pipeline Compromise: When the Factory Ships the Malware
A build pipeline compromise injects malicious code during CI/CD, so the software you sign and ship is already backdoored. Here is how it works and how to defend.
Multi-Stage Docker Build Security in 2026
Multi-stage builds are the right way to ship secure container images, but the security benefits depend on getting the stage boundaries right. A guide for 2026.
Why SLSA Level 3 Matters (and Level 4 Usually Doesn't)
SLSA Level 3 gives you verifiable build provenance that satisfies CISA M-22-18 and EO 14028. Level 4 adds hermetic builds most teams will never need.
Docker BuildKit Security Best Practices for 2026
BuildKit has been the default Docker builder for years, but its security features remain underused. Here are the practices that matter in 2026.
How to Implement SLSA Level 3 Practically
SLSA Level 3 requires hardened builds, verifiable provenance, and isolated build environments. Here is the practical path, not the theoretical one.
SolarWinds Sunburst: Five Years of Lessons in 2026
Half a decade after Sunburst, the build system compromise still defines how we think about software supply chain risk. A look at what stuck and what did not.
Software Provenance: An End-to-End Guide
Provenance answers where software came from and how it was built. Here is how to implement end-to-end provenance tracking from source to deployment.
Software Attestation Frameworks Compared: SLSA, in-toto, and Sigstore
Software attestation proves that your artifacts were built the way you claim. Here is a practical comparison of SLSA, in-toto, and Sigstore for securing your build pipeline.
webpack-cli: What It Does and How to Keep It Secure
webpack-cli is the command-line front end to webpack, and as a build-time dependency it deserves the same supply-chain scrutiny as your runtime packages.
fork-ts-checker-webpack-plugin: A Security-Minded Guide
The fork-ts-checker-webpack-plugin speeds up TypeScript builds by moving type checking off the main thread, and treating it as a build-time dependency has real security implications.
webpack-merge: What It Does and How to Use It Securely
webpack-merge cleanly combines webpack configs, but its low release cadence and function-executing merge behavior deserve a security-minded look.
maven-assembly-plugin: A Security Guide
The maven-assembly-plugin bundles your project into distributable archives. It builds archives rather than extracting them, which shapes exactly which supply chain risks apply to it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.