Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A quiet restore can mean no findings or no audit. Use RestoreProjectsAuditedCount in a solution targets file to fail CI when a project was not audited.
Add one line to .npmrc to send an npm scope to your private registry, scope the auth token correctly, and check that nothing falls back to the public one.
A step by step plan to upgrade a runtime or framework before its end-of-life date: scope, target, testing, rollout and a gate that stops drift.
Step by step guide to pip hash-checking mode: generate pinned hashes, install with require-hashes, handle platforms, and know what hashes do not prove.
Steps to pin dbt packages: exact versions, full commit hashes, a committed package-lock.yml, and a deliberate upgrade routine that you can review.
Pin every Python package with hashes and every model with a full commit hash. Steps for pip hash checking mode and a short ML reproducibility checklist.
Parse a purl from right to left: subpath, qualifiers, scheme, type, version, name, namespace. Follow the official order to avoid splitting on the wrong slash.
A CVSS vector string is a slash separated list of metric:value pairs. Here are the parsing rules for 3.1 and 4.0, and the traps that break naive parsers.
Use a branch ruleset with the Require code scanning results rule and alert thresholds. Steps, threshold choices and what to check before enforcing.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
