Open Source Security
Auditing Rust unsafe Code at Scale
How to actually audit unsafe blocks across a large Rust dependency graph without drowning in false positives or miss real issues.
Mar 15, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source Security
Java Modules Supply Chain Security
The Java Platform Module System arrived in Java 9 and has aged into quiet maturity. What JPMS actually does for supply chain posture in enterprise Java.
Mar 15, 20265 min read
Open Source Security
Ruby / Bundler Supply Chain Program 2026
A 2026 supply chain program for Ruby and Bundler — covering RubyGems, Gemfile.lock, native extensions, and Rails — anchored by Safeguard policy gates.
Mar 15, 20267 min read
Open Source Security
JRuby Supply Chain Considerations
JRuby sits at the intersection of the Ruby and Java supply chains, and the security story reflects both. A look at how JRuby's dual nature affects gem security and what defenders should know.
Mar 14, 20268 min read
Open Source Security
Rust Procedural Macros: Security Risks
Proc macros are Rust code that runs at compile time with the privileges of the developer. They are one of the most underexamined pieces of the Rust supply chain.
Mar 14, 20266 min read
Open Source Security
OpenSSF Scorecard Adoption Metrics: Late 2024
OpenSSF Scorecard crossed 1M scanned repos in October 2024. We break down adoption, score drift, and which checks are actually predictive.
Mar 13, 20265 min read
Open Source Security
crates.io's Security Team in 2026: Response Workflow, Notification Policy Change, and the Alpha-Omega Investment
After the September 2025 phishing wave and the December evm-units removal, the crates.io team announced a notification policy update in February 2026 and the Rust Foundation deployed crate-scanning infrastructure funded by Alpha-Omega.
Mar 12, 20267 min read
Open Source Security
dotnet restore Reproducibility Concerns
dotnet restore is supposed to be deterministic. In practice it is deterministic in ways that matter less and non-deterministic in ways that matter more.
Mar 12, 20267 min read
Open Source Security
Ruby Native Extensions Supply Chain
Native C extensions are the most under-audited part of the Ruby supply chain: how they get built, what can go wrong, and how to monitor them as seriously as you monitor pure-Ruby code.
Mar 12, 20268 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.