Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Build a dependency inventory in stages: customer facing repos first, direct and indirect packages, then owners, then a refresh tied to each change.
Turn per release SBOMs into a searchable index so a new advisory maps to affected products and versions in minutes. Fields, keys and a worked query.
npm's allow-git config can restrict git references to none or root only. When to use it, what it does not change, and how to roll it out safely.
Checked-in executables cannot be reviewed like source. Here is what the Binary-Artifacts check looks for, what it flags wrongly, and what to do about it.
A yanked module version is one a registry marks as best avoided, for example after a vulnerability. Bazel errors on it by default. Here is how to respond.
Vendor mode copies external dependencies into your repository so builds run offline and every byte is reviewable. Learn the commands and the trade-offs.
Bazel supports index registries as a directory or static HTTP server, with mirrors for source archives. Learn the layout and how to gain control.
Bazel modules replace hand-written WORKSPACE fetches with registry metadata, a resolved graph and a lockfile. See what that changes for supply chain risk.
Before enforcing a merged dependency policy, scan both codebases for a baseline: inventory, findings by rule, age, and ownership. What to record and why.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
