DevSecOps
What is CI/CD Pipeline Poisoning
CI/CD pipeline poisoning lets attackers hijack your build automation to steal secrets and plant backdoors. Here's how it works and how to stop it.
Mar 7, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source Security
Gradle Version Catalogs Security
Gradle version catalogs centralise dependency versions in one file. The security payoff is concrete: auditability, uniform enforcement, and a single PR gate.
Mar 7, 20265 min read
Buyer's Guides
Tugboat Logic alternatives and review
Tugboat Logic became part of OneTrust in 2021. Here's how compliance automation tools like Sprinto compare to Safeguard's software supply chain security approach.
Mar 7, 20268 min read
Vulnerability Management
NuGet Package Vulnerabilities Dashboard
Listing every CVE in your NuGet dependency tree is easy. Turning it into a dashboard someone can act on is the work. A practical design.
Mar 7, 20265 min read
DevSecOps
What is Artifact Signing
Artifact signing cryptographically verifies who built a software artifact and that it hasn't been tampered with — here's how it works and why it stops supply chain attacks.
Mar 7, 20266 min read
Industry Analysis
New Relic Security: Building a Supply Chain View
How to extend New Relic's APM and Vulnerability Management features into a working software supply chain dashboard for security and platform teams.
Mar 7, 20267 min read
Buyer's Guides
MetricStream alternatives and review
MetricStream is heavyweight enterprise GRC. Sprinto automates compliance workflows. See how Safeguard differs by scanning your actual software supply chain.
Mar 7, 20267 min read
Vulnerability Analysis
CVE-2025-1974 Ingress NGINX Controller RCE
IngressNightmare - CVE-2025-1974 in Kubernetes ingress-nginx - gave unauthenticated attackers cluster-wide RCE. Here is how it worked and what to harden now.
Mar 7, 20268 min read
Incident Analysis
The GitHub Dependabot Token Incident: Retrospective
In 2023, attackers used stolen GitHub personal access tokens to push malicious commits masquerading as Dependabot; a short-sharp incident with lasting lessons.
Mar 6, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.