Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
cache-mode sets whether a job can restore, save or neither. Low trust triggers get read only access to default branch caches. Here is what to set and why.
Put the runner OS and a hash of your lockfile in the cache key, and understand how restore-keys fall back to older caches before you add them.
Subtree keeps upstream history and a path to pull updates. A plain copy loses both. Compare the two for patching, tracking and security review.
Git LFS swaps large game assets for text pointers in the repo. What that means for scanners, shallow clones and Unity packages, and how to check CI.
Git's store helper writes passwords unencrypted on disk, while cache holds them briefly in memory. Learn how to pick a credential helper for your machine.
Short git hashes change length as a repository grows or a clone is shallow. Fix the length with abbrev settings and keep build dates out of versions.
Three forms of gh attestation verify cover a binary, a container image and an SBOM predicate. See the commands and what a pass does and does not tell you.
Two ways to handle generated SDK code: commit it for review, or generate in CI each build. Security and repeatability trade offs, and a decision guide.
OpenAPI Generator can limit output to chosen APIs and models. How selective generation shrinks attack surface and review effort, and what it cannot remove.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
