Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Withdrawn records, missing summaries, CWE coverage, severity, CVE aliases and fixed versions for eight OSV ecosystems in one table, plus how to compensate.
In OSV, 41.3 percent of crates.io advisories and 14.7 percent of npm advisories carry no CVE alias. A scanner that matches only on CVE IDs will miss them.
SLSA shows that an artifact came from the expected source and builder. It does not show the code is good. Here is what each level gives you and misses.
A short list of terms to look for in a managed or curated open source agreement: scope, response times, advisory format, end of life and exit.
Maven Central requires PGP signatures, checksums, license and SCM data. Learn what those checks tell you about a dependency and what they leave unproven.
Typosquatting publishes malicious packages with names close to popular ones, hoping for a typo. Learn the common patterns and simple habits that stop it.
SPDX is an open standard for exchanging SBOM data, recognized as ISO/IEC 5962:2021. Learn what it describes, and when teams choose it over CycloneDX.
Sigstore signs and verifies release files, container images and SBOMs using short-lived keys and a public log. Meet Cosign, Fulcio and Rekor.
OpenSSF Scorecard grades open source repositories from 0 to 10 on automated security practice checks. Here is what it measures and what it cannot tell you.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
