Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Build the commit twice, then compare both outputs with diffoscope. It unpacks archives and shows each byte level difference so you can name the cause.
Comparing two SPDX documents: ignore the Created time and document namespace, and compare package names, versions, identifiers and licenses. A field guide.
Plan for devices that return many releases behind: avoid version bound deltas, keep old signing roots valid, and treat silent units as unknown.
Which Apple certificate signs a Mac app? Use Developer ID Application for direct downloads and Mac App Distribution for the Mac App Store. Here is why.
Privileged mode, added capabilities, unconfined seccomp, extra mounts, run arguments and host side commands widen a dev container. Review these settings.
Dev, staging, and prod often install different dependency sets. Omit dev packages in production builds and compare the result to cut attack surface.
A vulnerable dev dependency rarely reaches your users, but it can reach your CI. How to rank these alerts, filter them, and decide when to act.
One scanner counts test and build dependencies, another skips them. Here is how npm and Maven scope settings change results, and how to pick one policy.
containerUser changes who the whole container runs as, remoteUser changes who your tools run as. The default is often root. Learn how to set both safely.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
