Dependency Security
JavaScript Dependency Security: The Complete Guide
A thorough walkthrough of securing your JavaScript dependency tree, from lockfile hygiene to automated auditing and runtime protections.
Jul 12, 20226 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A thorough walkthrough of securing your JavaScript dependency tree, from lockfile hygiene to automated auditing and runtime protections.
NGINX powers a third of the internet. Its default configuration is optimized for getting started, not for production security. Here is the gap.
Docker Content Trust never gained traction. Notary v2, now called Notation, is the replacement. Here is how to implement it and what has changed.
C and C++ libraries still power critical infrastructure everywhere. Their memory safety issues are your problem whether you write C or not.
Protobuf is everywhere in modern infrastructure. Its security implications go beyond just serialization format choice. Here is what to watch.
Content delivery networks serve billions of software assets daily. When a CDN is compromised, the blast radius is enormous. Here's what CDN supply chain risks look like and how to defend against them.
A practical comparison of SAST, DAST, and IAST — when to use each, where they overlap, and why most teams need more than one.
Software supply chain credentials, stolen signing keys, and zero-day exploits for build tools are traded on dark web forums. Monitoring these channels provides early warning of supply chain attacks.
A practical, step-by-step guide to generating your first Software Bill of Materials using open-source tools and integrating it into your development workflow.
Weekly insights on software supply chain security, delivered to your inbox.