Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Yes. Gradle buildSrc and build-logic hold code that runs in every build with direct access to the Gradle API. Here is how to review and protect it.
Installing and authorizing a GitHub App are different acts. Check the owner, the permissions and repository scope, then learn how to revoke access.
A reviewer checklist for pull requests that touch pipeline files: triggers, permissions, secrets, third-party actions, inline expressions and checkout.
Give each file a copyright notice and an SPDX-License-Identifier tag, keep license texts in a LICENSES folder, and use .license files for binaries.
Reusable workflows and composite actions both share CI logic in GitHub Actions. Here is how to choose for security scans, with a comparison table.
A five minute routine using deps.dev, the project repository and one install test to judge a package before you add it. Steps, what to record, what to skip.
Project metadata lists what code needs in loose terms, while a requirements file lists exact installs. Learn the split and why you usually need both.
A workflow skipped by path, branch or commit message filters leaves its required check pending and blocks merging. Why, and how to avoid a gate gap.
Use a ValidatingAdmissionPolicy to reject pods whose images are not pinned by digest. A tested CEL rule, rollout in warn mode, and cases to exempt.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
