Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Steps to restrict JupyterLab extensions: read only manager, allowlists or blocklists, locking plugins, and building approved extensions into the image.
Each package manager can print the full dependency tree, transitive packages included. Here are the commands for npm, Maven, Cargo, Go and .NET today.
Read Podfile.lock for CocoaPods, the resolved packages file for Swift Package Manager, and check for manually added frameworks. A short guide.
Run the Gradle dependencies task on the release classpath, then use dependencyInsight to see why a library is there. Commands and what to look for.
Read keys from the environment or a secret manager, never type them into cells, and scan before you commit. Steps to follow and what to do after a leak.
Prove it is a false positive, record the analysis with a standard justification, suppress narrowly with an expiry, and report bad data upstream.
Grouping cuts pull request noise, but a bad group hides one risky bump inside ten safe ones. Group by type and update level, and keep majors separate.
Generate CycloneDX SBOMs for Ruby with cyclonedx-ruby and for PHP with the Composer plugin: commands, spec versions, dev dependency handling, validation.
Two ways to get a Rust SBOM: cargo-cyclonedx from the project, or cargo-auditable data embedded in the binary. What each records and when to use it.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
