Security Guides
Can a Node.js production image ship without npm and Yarn?
Yes, with a multi-stage build that copies only the node binary and your built app. Why it shrinks attack surface, and what you give up when you do it.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Shared logins at a nonprofit: what should you use instead?
Shared passwords on a sticky note or spreadsheet put a nonprofit at risk. Here is a simple alternative using individual accounts and a password manager.
Oct 19, 20263 min read
Security Guides
No license, unknown license or custom license: what is the difference?
No license means no permission, unknown means a scanner could not tell, and custom means non-standard terms. Each one needs a different action.
Oct 19, 20263 min read
Security Guides
What should you do when an SCA report says no fix is available?
When an SCA finding has no fixed version, check reachability and exploit signals, apply mitigations, record the decision and set a review date.
Oct 19, 20264 min read
Security Guides
No-code, low-code and RPA: what differs for security?
No-code and low-code build apps, RPA drives existing apps like a user. The risks overlap but the main exposures differ. Compare them in one table.
Oct 19, 20264 min read
Security Guides
Why report new and inherited vulnerabilities separately?
Splitting findings into newly introduced and inherited shows whether a team is creating risk or paying down old debt. Here is how to split and report them.
Oct 19, 20263 min read
Security Guides
New region or DR site: a dependency parity checklist
A disaster recovery site on older packages can fail you when it matters. Use this checklist to keep a new region or DR site on the same artifacts.
Oct 19, 20263 min read
Security Guides
What is the new immutable OIDC sub format on GitHub?
Repositories created after July 15, 2026 use an OIDC sub claim with owner and repository IDs. What changed, who is affected, and how to update trust rules.
Oct 19, 20264 min read
Security Guides
Is .NET Framework 4.6.2 out of support soon? What 4.8 shows
Microsoft's lifecycle page lists .NET Framework 4.6.2 ending in January 2027, while 4.8 and 4.8.1 show no end date there. How to record each version.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.