Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A program plan for getting OCI artifact signing across an organisation: trust roots, key custody, build integrations, registry policy, and the inevitable cleanup of unsigned legacy content.
A senior engineer's view of how NYDFS Part 500 amendments through 2025 and 2026 reshape software supply chain expectations for regulated financial institutions.
Cody's codebase-wide context is valuable for security review. Griffin AI adds reachability, taint, and policy grounding that Cody doesn't target.
A hijacked tool call is more consequential than a hijacked response. The defence requires the tool layer to police the model, not the other way around.
A one-hour cycle from vulnerability finding to merged fix is achievable in 2026, but only with a pipeline designed for it. Here is what that pipeline looks like.
FedRAMP's continuous monitoring requirements now include supply chain risk. Learn how to produce monthly evidence aligned with NIST SP 800-161 controls.
Container security scanning tools find vulnerabilities in your images, layers, and dependencies before they reach production. Here is how the categories compare and what to look for.
A secure development model bakes security into every phase of building software instead of bolting it on at the end. Here is how the model works and how to adopt one without slowing delivery.
AI explainability is the ability to understand why a model produced a given output. In security, it is the difference between an alert you can act on and one you cannot.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
