sca
Safeguard articles tagged "sca" — guides, analysis, and best practices for software supply chain and application security.
469 articles
Open source vulnerability management workflow (detect, pr...
A concrete look at the detect-prioritize-remediate workflow for open source vulnerability management, where Mend.io's SCA approach falls short, and how Safeguard closes the gap.
Joi npm: A Security Review and Safe Usage Guide
The joi npm package is the widely used JavaScript schema validation library. Here is its maintenance status, the @hapi/joi migration, and how to use it safely.
5 best practices for React with TypeScript security
TypeScript's type system stops at compile time. Five concrete practices — with real CVEs and incidents — for securing React + TypeScript apps against what it misses.
SBOM security: key components and top use cases
A practical breakdown of SBOM security components and top use cases—incident response, compliance, M&A—plus how Safeguard's approach differs from SCA-first tools like Mend.io.
JavaScript Vulnerability Scanner: How It Works and What to Use
A JavaScript vulnerability scanner finds risky dependencies and insecure code across your Node and browser projects. Here is how the different types work.
npm commander: Security Review and Safe Usage of the CLI Library
The npm commander package is one of the most-downloaded CLI frameworks for Node. Here is a security-focused review of the library and how to use it safely.
The Quiet Consolidation of SCA, SAST, and Container Scann...
A wave of PE buyouts and platform acquisitions is quietly folding SCA, SAST, and container scanning into fewer, bigger AppSec platforms. Here's what's driving it.
License compatibility when combining open source components
Open source license conflicts like GPL-Apache incompatibility often surface after merge. Here's why scanners miss them and how build-time enforcement closes the gap.
10 dimensions of Python static analysis
Python static analysis spans ten distinct techniques, from AST linting to reachability analysis — most teams run only two or three, missing real exploitable risk.
Secure Code Analysis: How to Find Bugs Before They Ship
Secure code analysis combines static, dependency, and dynamic techniques. Here is what each one finds, where they overlap, and how to build an analysis pipeline developers won't route around.
tomcat-embed-core in Maven: A Security Guide to CVEs and Fixes
The tomcat-embed-core Maven artifact is the embedded Tomcat engine inside most Spring Boot apps, and it has carried several serious CVEs. Here is how to find your version and patch it.
Cloud Scanning vs Hybrid Scanning: Deployment Models for ...
SaaS vs self-hosted SCA deployment compared on data residency, air-gap support, and audit scope, with a look at how Safeguard's flexible deployment model differs from cloud-only platforms.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.