Tag
checksum-database
Safeguard articles tagged "checksum-database" — guides, analysis, and best practices for software supply chain and application security.
3 articles
Open Source Security
Go module checksum database bypass risks
Go's GOSUMDB checksum verification is meant to be on by default, but Safeguard's research found roughly 1 in 6 CI pipelines quietly disable it.
Nov 18, 20257 min read
Engineering
Go Module Security: sumdb, GOPROXY and Private Modules
How Go's checksum database actually protects you, where GOPROXY ordering bites, and the GOPRIVATE mistakes that leak internal module paths to public infrastructure.
Feb 27, 20257 min read
Software Supply Chain Security
Go Module Checksum Database: How It Secures Your Dependencies
Go checksum database is one of the most underappreciated supply chain security features in any language ecosystem. Here is how it works and where it falls short.
Mar 18, 20235 min read