Regulatory Compliance
State and Local Government SBOM Mandates
States and cities are adopting SBOM requirements faster than most vendors have noticed. A survey of where the mandates sit and what they actually require.
Mar 13, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedBuyer's Guides
Secureframe alternatives / competitors comparison
Secureframe is built for compliance audits; Safeguard is built for software supply chain security. Here is how the two actually compare.
Mar 13, 20267 min read
SBOM & Compliance
SLSA Build Provenance for Python Publish
Python packages on PyPI can carry SLSA provenance via PEP 740. Here is the publish workflow, the verification story, and the parts that still do not quite fit together.
Mar 12, 20267 min read
DevSecOps
go generate Supply Chain Risks
go generate is a seam where arbitrary commands run with the full privileges of the developer, and it does not show up in any manifest of trusted dependencies.
Mar 12, 20267 min read
Compliance & Frameworks
CISA's SBOM Sharing Lifecycle: A Framework for Practical Adoption
CISA releases updated guidance on SBOM sharing practices, addressing the full lifecycle from generation to consumption across supplier and buyer relationships.
Mar 12, 20266 min read
Concepts
What Is a JWT (JSON Web Token)
A JWT is a compact, signed token that carries claims like who a user is between parties. Learn its three parts, how signing works, and the common security pitfalls.
Mar 12, 20266 min read
Engineering
CycloneDX and SPDX: Why Safeguard Supports Both and How We Normalize Between Them
The SBOM format debate misses the point. Safeguard ingests both CycloneDX and SPDX, normalizes to a common model, and lets you query and export in either format.
Mar 12, 20267 min read
AI Security
Security Testing for LLM-Powered Applications
Applications built on large language models introduce novel attack surfaces that traditional security testing does not cover. This guide addresses the specific testing methodologies needed for LLM applications.
Mar 12, 20267 min read
Tools
CodeQL vs Snyk: A Buyer Comparison for 2026
A side-by-side comparison of CodeQL and Snyk in 2026 across SAST, SCA, container, and IaC coverage, with realistic expectations for each.
Mar 12, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.