Security Guides
How do I report a suspicious package I find in week one?
Found a package that looks malicious? Stop installing it, keep evidence, tell your security contact, and report it to the registry. Steps for new hires.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do I check if the software I use has a known vulnerability?
Find the exact product and version, read the vendor's security notices, check CISA's exploited list, then update. A step by step guide for non-experts.
Oct 19, 20264 min read
Security Guides
How do certificate bound access tokens work for partner APIs?
Certificate bound tokens tie an access token to a partner's TLS client certificate, so a leaked token fails elsewhere. How the check works, step by step.
Oct 19, 20264 min read
Security Guides
How did we find out? Writing the detection section of a postmortem
Detection sections should say who noticed, which signal, how long it took and what would have caught it sooner. A short guide for supply chain incidents.
Oct 19, 20263 min read
Security Guides
How can defenders use the Exploit Database safely?
The Exploit Database is a public archive of exploits and proofs of concept. How a defender can use it as one signal, and what it cannot prove about risk.
Oct 19, 20264 min read
Security Guides
How can a school check an edtech app's dependencies before buying?
A buyer checklist for district technology staff: what to ask a vendor about open source, updates, and third parties, and what good answers look like.
Oct 19, 20264 min read
Security Guides
How do you ship an urgent hotfix without bypassing controls?
An emergency path for health app releases that is fast, logged and reviewed after the fact: who approves, what is skipped, and what is never skipped.
Oct 19, 20263 min read
Security Guides
Should a hotfix branch start from the release tag or from main?
Branch a security hotfix from the tag that is running in production, fix it on main first where you can, and merge the fix back so it is never lost.
Oct 19, 20264 min read
Security Guides
Hosted or self-hosted package mirror: how should a small team decide?
A decision guide for choosing a hosted or self-hosted package mirror: who patches it, who holds the data, and the questions to ask before committing.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.