Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
GitLab pipeline schedules run with their owner's permissions and can go inactive. What to set up for recurring scans, and why to stagger the cron times.
The shell executor gives no clean build and no protected file system. Docker and Kubernetes isolate better. A plain comparison for choosing a runner.
A protected runner accepts jobs from protected branches and tags solely. How to set one up, how tags route jobs, and what to check on instance runners.
A merge request pipeline gets protected variables and runners only when three conditions hold. Here they are, why forks never qualify, and how to check.
Artifacts expire by expire_in or the instance default, but the latest are kept. Covers artifacts:access, dependencies, and why not to use them as releases.
Yes. GitLab ID tokens let a job prove who it is to a cloud provider with a short-lived JWT. Here is how the claims work and which ones to trust.
The dependency proxy caches Docker Hub images to cut pulls and rate limits. It is not a safety check. How it authenticates and how to pin by digest.
Add a CODEOWNERS rule for the pipeline file, protect the branch, require code owner approval, and close the push loophole. Setup steps and a check.
Yes. GitLab warns debug logging exposes every variable and secret a job can use. Who can see it, the runner variable trap, and how to clean up afterwards.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
