Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CycloneDX compositions let you declare parts of an inventory complete, incomplete or unknown. A short guide to using the completeness values honestly.
List dev and test dependencies only if you label them. CycloneDX scope separates required, optional and excluded components so readers judge risk.
How CycloneDX vulnerability analysis states and justifications line up with OpenVEX statuses and justifications, and where the mapping is not one to one.
What should a curated open source catalog actually check? A practical checklist covering source, build, maintainers, advisories and removal rules.
What a CSAF 2.0 document must contain to count as a VEX profile document: product tree, product status, impact statements and action statements.
A pull-through cache gives you one controlled place to pull images from. It also adds a system to secure. Here are the tradeoffs and settings to check.
Two public cases show a compromised tool leading to a second compromise downstream. How the chain works and where to cut it in your own pipeline.
Yanking hides a crate version from new resolution but keeps the code downloadable and leaves existing lockfiles alone. How to respond to a bad release.
How SLSA build levels help a buyer judge whether a target's releases can be trusted, and what a seller can truthfully claim about its build pipeline.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
