Security Guides
Scan the built output or the source repo of a static site?
Scan both, for different reasons. The lockfile shows what you chose, the built folder shows what shipped. Compare approaches and what each one misses.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Why did my scan results change overnight with no code change?
Scan output can change without a commit because advisory data changes: new records, edited ranges, added severities and withdrawals. How to find the cause.
Oct 19, 20264 min read
Security Guides
Scan flags a package your app never uses: remove it or patch it?
If a flagged package is not needed at runtime, removing it beats patching it. Here is how to decide, and how to remove it without breaking the image.
Oct 19, 20264 min read
Security Guides
How do you scan fork pull requests without exposing secrets?
Run the scan on pull_request with no secrets, hand off results as data, and let a second workflow report them. Steps, risks and what to never execute.
Oct 19, 20264 min read
Security Guides
Can you scan a legacy monorepo that no longer builds?
Yes, partly. Manifest based dependency scanning works without a build, but results are less exact. How to scan old code and what to treat with care.
Oct 19, 20264 min read
Security Guides
How do you find which package pulled in a vulnerable dependency?
Use the dependency path in your SCA report, or npm explain and Maven's dependency tree, to find which direct package pulled in a vulnerable library.
Oct 19, 20263 min read
Security Guides
How do you know your SCA report covered the whole codebase?
Before you trust a clean SCA report, check what it scanned. A five-point coverage check for repos, lockfiles, ecosystems, monorepo folders and base images.
Oct 19, 20264 min read
Security Guides
Which roles does an SBOM platform need? Viewer, editor, approver, exporter
A practical role model for SBOM platform access control: who should view, upload, edit, approve and export, with least privilege and a review cadence.
Oct 19, 20264 min read
Security Guides
What do I do when an SBOM lists a component I do not recognize?
An unfamiliar name in a vendor SBOM is usually a transitive dependency. Five steps identify it: PURL, registry page, references, parent and hash.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.