DevSecOps
How to Set Up Sigstore in Your Build Pipeline
Wire Sigstore into GitHub Actions end-to-end: OIDC identity, Cosign signing, Rekor transparency, and policy-controller enforcement — with working snippets.
Feb 28, 20244 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Wire Sigstore into GitHub Actions end-to-end: OIDC identity, Cosign signing, Rekor transparency, and policy-controller enforcement — with working snippets.
A field analyst's look at how North Korea's Lazarus Group has turned software supply chains into a strategic weapon, from 3CX to npm.
Operation Cronos seized LockBit's leak site in February 2024. We unpack the NCA-led takedown, the decryptor release, and LockBit's rapid rebuild.
Running workloads across AWS, Azure, and GCP multiplies your attack surface. This guide covers cloud security posture management with a supply chain lens.
A step-by-step guide to launching a security champions program that scales your security team's influence across engineering without hiring a dozen new AppSec engineers.
Not all vendors are equal when it comes to security. Here is how to build a scorecard that objectively evaluates vendor security practices and informs procurement decisions.
How Earthly's reproducible, containerized build system eliminates environment drift and strengthens build integrity for security-conscious teams.
CISA publishes a roadmap urging the industry to transition to memory-safe programming languages, targeting the root cause of roughly 70% of critical vulnerabilities.
NIST CSF 2.0 introduces a new Govern function and expands supply chain risk management. Here's what security teams need to know.
Weekly insights on software supply chain security, delivered to your inbox.