Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
When the original maintainer disappears, a fork may take over. How to check who runs it, what changed, how it is published and whether to switch.
Search the GitHub Advisory Database for malware entries, check OSV, and compare names for lookalikes before you install. Steps and what to do on a match.
Bus factor is the smallest number of contributors behind half of a project's work. Here is how to compute it from git history in five minutes.
If your product bundles software made by someone else, the SBOM should name the producer, link or request their SBOM and say what you could not get.
A typo in an install line sends readers to the wrong package. Show exact names, link the official registry page, and pin versions so a copy stays correct.
Most supply chain attacks start at one of five entry points: stolen credentials, a hijacked maintainer, CI abuse, name tricks or a poisoned update.
Provenance links an npm package to its source and build. Learn how to verify it with npm audit signatures and what a provenance badge does not prove.
Match review depth to risk: a quick check for small low-risk libraries, a full evaluation for anything touching auth, crypto, or untrusted input.
A conda-forge package comes from a feedstock repository, built on CI with validation before upload. What that process gives you and what it cannot.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
