build-security
Safeguard articles tagged "build-security" — guides, analysis, and best practices for software supply chain and application security.
20 articles
You Tested a Different Artefact Than the One You Shipped
Tests pass against a build with debug assertions, development dependencies and verbose errors. You then ship something compiled differently, with a different dependency set, that behaves differently when something goes wrong.
Your Internal Package Registry Is the Only Control That Runs Before the Code Does
Most companies run one and treat it as a cache. It is the one place in the build that can refuse a package before an install script executes, which is the only point where prevention is still possible.
Software Provenance: An End-to-End Guide
Provenance answers where software came from and how it was built. Here is how to implement end-to-end provenance tracking from source to deployment.
Build Pipeline Compromise: When the Factory Ships the Malware
A build pipeline compromise injects malicious code during CI/CD, so the software you sign and ship is already backdoored. Here is how it works and how to defend.
Software Attestation Frameworks Compared: SLSA, in-toto, and Sigstore
Software attestation proves that your artifacts were built the way you claim. Here is a practical comparison of SLSA, in-toto, and Sigstore for securing your build pipeline.
webpack-cli: What It Does and How to Keep It Secure
webpack-cli is the command-line front end to webpack, and as a build-time dependency it deserves the same supply-chain scrutiny as your runtime packages.
fork-ts-checker-webpack-plugin: A Security-Minded Guide
The fork-ts-checker-webpack-plugin speeds up TypeScript builds by moving type checking off the main thread, and treating it as a build-time dependency has real security implications.
webpack-merge: What It Does and How to Use It Securely
webpack-merge cleanly combines webpack configs, but its low release cadence and function-executing merge behavior deserve a security-minded look.
maven-assembly-plugin: A Security Guide
The maven-assembly-plugin bundles your project into distributable archives. It builds archives rather than extracting them, which shapes exactly which supply chain risks apply to it.
Multi-Stage Docker Build Security in 2026
Multi-stage builds are the right way to ship secure container images, but the security benefits depend on getting the stage boundaries right. A guide for 2026.
copy-webpack-plugin and terser-webpack-plugin: Build Pipeline Hygiene
The copy-webpack-plugin npm package and terser-webpack-plugin sit in almost every webpack build. Here's how to configure both without leaking files or shipping stale minifiers.
Why SLSA Level 3 Matters (and Level 4 Usually Doesn't)
SLSA Level 3 gives you verifiable build provenance that satisfies CISA M-22-18 and EO 14028. Level 4 adds hermetic builds most teams will never need.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.