build-security
Safeguard articles tagged "build-security" — guides, analysis, and best practices for software supply chain and application security.
37 articles
Software Provenance: An End-to-End Guide
Provenance answers where software came from and how it was built. Here is how to implement end-to-end provenance tracking from source to deployment.
Build Pipeline Compromise: When the Factory Ships the Malware
A build pipeline compromise injects malicious code during CI/CD, so the software you sign and ship is already backdoored. Here is how it works and how to defend.
Software Attestation Frameworks Compared: SLSA, in-toto, and Sigstore
Software attestation proves that your artifacts were built the way you claim. Here is a practical comparison of SLSA, in-toto, and Sigstore for securing your build pipeline.
webpack-cli: What It Does and How to Keep It Secure
webpack-cli is the command-line front end to webpack, and as a build-time dependency it deserves the same supply-chain scrutiny as your runtime packages.
fork-ts-checker-webpack-plugin: A Security-Minded Guide
The fork-ts-checker-webpack-plugin speeds up TypeScript builds by moving type checking off the main thread, and treating it as a build-time dependency has real security implications.
webpack-merge: What It Does and How to Use It Securely
webpack-merge cleanly combines webpack configs, but its low release cadence and function-executing merge behavior deserve a security-minded look.
maven-assembly-plugin: A Security Guide
The maven-assembly-plugin bundles your project into distributable archives. It builds archives rather than extracting them, which shapes exactly which supply chain risks apply to it.
Multi-Stage Docker Build Security in 2026
Multi-stage builds are the right way to ship secure container images, but the security benefits depend on getting the stage boundaries right. A guide for 2026.
copy-webpack-plugin and terser-webpack-plugin: Build Pipeline Hygiene
The copy-webpack-plugin npm package and terser-webpack-plugin sit in almost every webpack build. Here's how to configure both without leaking files or shipping stale minifiers.
Why SLSA Level 3 Matters (and Level 4 Usually Doesn't)
SLSA Level 3 gives you verifiable build provenance that satisfies CISA M-22-18 and EO 14028. Level 4 adds hermetic builds most teams will never need.
Docker BuildKit Security Best Practices for 2026
BuildKit has been the default Docker builder for years, but its security features remain underused. Here are the practices that matter in 2026.
CVE-2023-45133: Babel's Arbitrary Code Execution Flaw Explained
CVE-2023-45133 lets crafted code execute arbitrary commands during Babel compilation. Here's who is at risk, why it scores 9.3, and how to patch it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.