Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A Python template can pin exact versions, check hashes and avoid building source packages at install time. Here is what pip supports and how to adopt it.
A Python SBOM from requirements.txt may miss transitive packages. Compare it with pip freeze or pip inspect to see what really got installed.
Python treats Friendly-Bard and friendly_bard as one package. Here is the rule, why scanners can mismatch on it, and how to normalize before comparing.
Yes, applications should commit a Python lock file. See what poetry.lock and uv.lock record and how they differ from the ranges in pyproject.toml.
Python versions pass through bugfix, security and end-of-life phases. Learn what each phase covers, which versions sit where today and when to upgrade.
A green check on a PyPI project URL means control at upload time only. How verification works, how to add URLs in pyproject.toml, and the Security label.
Yes. A PyPI pending publisher lets your first release come from CI through trusted publishing, so no long-lived upload token ever exists. Steps and limits.
A config review of the registry proxy block: remoteurl, ttl, stored upstream credentials, delete for cleanup, and the Docker Hub only limit of the daemon.
Pull request scans and scheduled scans answer different questions. Why mixing their metrics gives misleading scan time, failure and findings numbers.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
