Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Aikido found XCSSET macOS malware in the example folder of universal_file_viewer 0.1.5 on pub.dev. Depending on the package is not the risk; building its example is.
Aikido reported that four npm packages published on 7 September 2026 carried a payload with the same hash as the May @antv wave, after 111 days with no sightings.
Gold is Safeguard's free, public directory of open-source security data. What it covers, what Gold Certified really means, and where the data comes from.
VEX says whether a known vulnerability actually affects a product. Here is which formats Safeguard accepts, how to upload them, and what a good VEX file needs.
Connect a repository, image or manifest and Safeguard builds the SBOM. Bring one from a vendor and it validates, enriches and monitors it. Both paths, step by step.
Pin dependencies by committing a lockfile, installing from it in CI with npm ci or pip --require-hashes, and reviewing every lockfile change.
To sign container images and release files, use Sigstore cosign keyless signing from CI, then verify the signer identity and issuer before you deploy.
Aikido reported two Terraform providers and two Go modules that carried a Go port of Graphalgo malware, including a typosquat of a widely used Docker provider.
VEX states whether a vulnerability affects your product. How VEX works, OpenVEX, CSAF and CycloneDX formats, and tools like vexctl, Trivy and Grype.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
