Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Read settings.gradle to list subprojects, resolve each one's dependencies by project path, and report per subproject so findings reach the right team.
Yes. A scanner can read an image from a tar archive, an OCI layout directory or a registry, with no daemon or running container. Here is when to use each.
Scan a Maven multi-module build from the aggregator POM so the reactor sees every module, then check parent and managed version coverage. Steps inside.
Each Go module has its own go.mod, and go.work adds modules to a workspace. Scan every module, and watch how workspace mode can change selected versions.
Zephyr can generate SPDX documents for a build with west spdx. The three commands, what the four documents contain, and what the output cannot tell you.
Docker's BuildKit SBOM covers only the final stage by default. How to include earlier stages or the build context, and what to inspect before you push.
A Maven SBOM lists declared dependencies, but a shaded uber jar bundles and renames classes. Check the SBOM against the jar and keep any gap visible.
A supplier SBOM that will not load usually fails for one of seven reasons, from encoding to duplicate references. A checklist to find and report the cause.
Set a scan time budget before you pick a static analysis tool. What to measure, how to separate pull request scans from full scans, and when slow is fine.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
