Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Start a maintainer security program in a weekend: protect the default branch, publish without long lived tokens, pin build inputs, and offer a report path.
OCI artifacts let a registry hold SBOMs, signatures and charts using the image manifest. Secure them with digests, signature checks and scoped writes.
NuGet tries every configured source by default. Map each package ID to one source, verify signatures and review new names to stop confusion and typosquats.
If a malicious NuGet package reached your build, find it, contain it, rotate secrets, then use source mapping and central versions so it cannot recur.
Check the ID prefix, owner and signature, audit for known flaws, map package sources and see why a transitive package is in your graph before you install.
Ten npm habits that cut supply chain risk: lockfiles, npm ci, audit, install scripts, 2FA, provenance, scoped tokens, pinned CI actions, fewer packages.
The 2025 Shai-Hulud worm spread through stolen npm credentials. Lock installs, block install scripts, harden publisher accounts and know your dependencies.
Lockfiles make installs repeatable, but they are rarely reviewed. A changed resolved URL or integrity value can slip through a diff. Here is what to check.
Check what a package runs at install, who publishes it, whether provenance verifies and what it pulls in. A short pre-install routine you can finish fast.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
