Developer Tools
What does each build system's SBOM generator actually read?
A cheat sheet of what the CycloneDX generators for Maven, Gradle, npm, Python and Go read as input, and the check to run before trusting output.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
What does defaultStatus unknown mean in a CVE record?
In a CVE record, defaultStatus says what to assume about versions not listed. Unknown is the default. Learn how that changes a scanner's verdict and what to do.
Oct 19, 20263 min read
Developer Tools
What does default allow := false do in a Rego policy?
The default keyword gives a rule a value when no rule body matches. Why default allow := false makes a Rego policy fail closed, with a short example.
Oct 19, 20264 min read
Developer Tools
What does cargo build with the locked flag do, and when to use it?
The locked flag makes Cargo fail instead of changing Cargo.lock. Use it to build exactly the dependency versions you reviewed, and know what frozen adds.
Oct 19, 20263 min read
Developer Tools
What does an SBOM show for a distroless or minimal container image?
Distroless images have no shell or package manager, which can change what a scanner finds. Learn what to expect in the SBOM and how to check it.
Oct 19, 20264 min read
Developer Tools
What does a verified plugin publisher badge prove, and what does it not?
A verified publisher badge proves domain ownership and good standing, not safe code. See what marketplaces check and how to build a useful trust signal.
Oct 19, 20264 min read
Developer Tools
What does a stable branch accept? The Linux kernel rules as a model
The Linux kernel stable tree takes fixes that already exist upstream, are tested and stay small. What those rules teach any project that backports.
Oct 19, 20264 min read
Developer Tools
What does a security IDE plugin send home? Questions to ask
An IDE security plugin can read open files and send data out. Here is what to ask about telemetry, code transfer and settings before rolling one out.
Oct 19, 20263 min read
Developer Tools
What does a free dependency scan actually check in my app?
A dependency scan lists the open source parts in your app and compares each against known vulnerability data. Here is what it finds and what it cannot.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.