Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
One curl call returns the EPSS score and percentile for any CVE. We ran it on three KEV additions from 14 to 16 October 2026 and the results differ sharply.
A hands-on run of osv-scanner against a real npm lockfile holding two known fast-jwt advisories, with the commands, the output, and the exit code explained.
A field-by-field reading of a real GitHub advisory published on 15 October 2026 for @opennextjs/cloudflare, with the OSV command to pull the raw record.
npm ci refuses to run when package.json and the lockfile disagree. We trigger the real error and show why that failure is the control you want.
uv sync with the locked flag errors when uv.lock is out of date, while the frozen flag skips the check. We reproduce both with uv 0.13.1, released 14 October 2026.
A vulnerable fast-jwt arrives through @fastify/jwt. We trace it with npm explain, fix it with npm update, and show when you need overrides instead.
RFC 9116 needs two fields and one URL. Most broken security.txt files fail on Expires, content type or location. Here is a working file and a CI check.
You maintain a library and do not want a bounty program. Here is the small setup that works: SECURITY.md, GitHub private vulnerability reporting, a draft advisory, and a CVE request.
A VDP is a front door with promises. A bug bounty adds money, rules and volume. Here is how to decide which you need, and the order that avoids burning your team out.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
