Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
VEX documents should be signed. What CISA and OpenVEX say about signing, what the signature must cover, and when HTTPS alone may be enough for consumers.
A VEX file is a claim, not proof. How to judge a supplier's not_affected statements by author identity, evidence type, consistency and update history.
The Cargo FAQ says committing Cargo.lock depends on your package. A decision guide for binaries, libraries and CI, with the supply chain angle.
When should a vendor get a CVE ID for its own fixed bug? Customer impact, who can assign one, how coordinators help, and when you can skip it.
Scorecard's Signed-Releases check looks for signature or provenance files on the last five releases. See what counts, what it skips, and how to pass.
The Scorecard Maintained check looks at commits and issue activity over 90 days. Learn what a low score means for stable libraries and how to follow up.
Reviewers read your extension code but may miss a vulnerable library in the bundle. How to inventory and scan extension dependencies before each release.
SCA reads your manifests; container scanning reads the built image. They share findings but see different packages. Learn what each one misses.
SCA reports vulnerabilities only when it can identify a component. Learn how evidence and matching work, and why vendored or renamed code slips past.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
