Analysis
Dependency Pinning vs. Ranges: The Tradeoffs
Should you pin exact dependency versions or use ranges? The answer is more nuanced than most teams think, and getting it wrong has real security implications.
Jan 21, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIncident Response
GitHub RSA SSH Key Rotation Incident: Why It Mattered
GitHub rotated its RSA SSH host key after accidental exposure. A small mistake with major supply chain implications for every Git-based workflow.
Jan 21, 20266 min read
Tool Comparisons
Dependabot vs Renovate: Which Dependency Update Bot Should You Use?
A practical guide comparing Dependabot and Renovate for automated dependency updates, covering configuration flexibility, ecosystem support, and team workflows.
Jan 21, 20266 min read
Ransomware
Royal Ransomware: Why Healthcare Became the Primary Target
Royal ransomware emerged from the ashes of Conti to become one of the most aggressive operations targeting healthcare organizations in 2022 and 2023.
Jan 21, 20267 min read
Application Security
Cryptographic Library Selection Guide: Choosing Wisely for Your Stack
Picking the wrong crypto library means either rolling your own crypto or using a library with a poor security track record. Here is how to choose.
Jan 21, 20265 min read
AI Security
Securing AI/ML Pipelines: The Supply Chain You're Not Watching
AI/ML pipelines introduce unique supply chain risks from training data to model distribution. Most organizations have zero visibility into this attack surface.
Jan 21, 20266 min read
Incident Analysis
T-Mobile API Breach: 37 Million Records Stolen Through an Unsecured API
In January 2023, T-Mobile disclosed that an attacker exploited an API to steal personal data of 37 million customers. It was their ninth major breach in five years.
Jan 21, 20266 min read
Cloud Security
OpenShift Pipelines with Sigstore: A Production Integration Guide
OpenShift Pipelines (Tekton) plus Sigstore gives you keyless signing inside a regulated cluster. The integration patterns are subtle. We map the ones that survive audit.
Jan 21, 20267 min read
Standards
ISA-TR62443-2-2-2025: Security Protection Schemes for IACS
The ISA released TR62443-2-2-2025 in December 2025, giving industrial operators actionable guidance for designing and validating a Security Protection Scheme. Here is what changed in OT defender practice.
Jan 21, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.