Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
The 2026 CISA guidance says there is no minimum depth, so transitive dependencies belong in the SBOM. How to check yours actually goes all the way down.
The 2026 minimum elements add a hash value and algorithm per component. What to hash, which algorithms CycloneDX allows, and SPDX's two kinds of checksum.
Pickle model files can run code when loaded. Safetensors and GGUF store tensors as data. How the three formats differ and what to check before loading.
Reproducible builds let anyone rebuild an artifact and get the same bytes. SOURCE_DATE_EPOCH removes one big source of variation: timestamps.
A build is reproducible when anyone can rebuild bit for bit identical artifacts from the same inputs. See how it catches tampering and what blocks it.
A dependency update broke or compromised a build. Restore the last good lockfile, install strictly, rebuild clean, and check exactly what shipped.
A package-lock.json lists exact versions, sources and integrity hashes. Learn which fields to check in a pull request and what a bad diff looks like.
Most vulnerable packages arrive indirectly. See how reachability follows a chain of dependencies, why it helps, and when the chain hides the answer.
A reachability filter can cut a findings list by 90 percent, but the numbers that matter are what it keeps and what it drops. A worked example and checks.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
