Compliance
Can you ship an ODbL dataset inside your product?
The ODbL asks for attribution, share-alike on adapted databases, and a keep-open rule. A product team workflow for tracking datasets next to code.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
What is a minimum viable vulnerability exception process?
A small team can run exceptions on one page: five fields, one approver, one expiry and one list. Here is the short version an auditor can follow.
Oct 19, 20263 min read
Compliance
What goes in a one page supply chain security policy for a small team?
A one page supply chain security policy outline for small teams: scope, owner, dependency and pipeline rules, exceptions and review, in plain language.
Oct 19, 20264 min read
Compliance
What goes in a one page dependency evidence pack for a game build?
A single page that answers what is in this build: engine, packages, plugins, native libraries, scan date and owners. Use it for partners and audits.
Oct 19, 20263 min read
Compliance
What does each type of open source license ask you to do?
A checklist of what permissive, weak copyleft and strong copyleft licenses ask when you distribute, with the exact notices behind MIT, BSD, Apache and MPL.
Oct 19, 20263 min read
Compliance
What extra duties does NYDFS give a Class A company?
NYDFS Class A companies face independent audits, privileged access management, password blocking, EDR and central logging. Who counts and what changes.
Oct 19, 20263 min read
Compliance
How do engineers help with the NYDFS annual risk assessment?
NYDFS 500.9 requires a documented risk assessment, updated yearly and after material changes. Inputs engineering supplies.
Oct 19, 20263 min read
Compliance
What does NYDFS 500.8 require for in-house and bought software?
NYDFS 500.8 needs written secure development procedures for in-house apps and a way to evaluate external apps, reviewed yearly by the CISO. What to write.
Oct 19, 20263 min read
Compliance
How do you run the annual access review NYDFS 500.7 requires?
NYDFS 500.7 requires least privilege, limited privileged accounts and a yearly access review. Steps for engineering teams, from export to evidence.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.