Compliance
Do GitLab merge request approvals count as change evidence?
On GitLab Free, approvals are optional and do not block merging. Required approval rules need Premium or Ultimate. Learn what that means for evidence.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Can GitLab audit events be used as audit evidence? Limits to know
GitLab audit events are kept indefinitely, but group and project views need a paid tier and API queries cap at 30 days. Here is how to plan exports.
Oct 19, 20263 min read
Compliance
Can GitHub environment approvals serve as deployment evidence?
Required reviewers, self-review blocking and branch limits on GitHub environments can show who approved a release. Here is what to configure and keep.
Oct 19, 20263 min read
Compliance
Do GitHub branch protections apply to admins? What auditors ask
By default branch protection rules do not bind admins. Learn the setting that changes it, how rulesets handle bypass, and what to show an auditor.
Oct 19, 20264 min read
Compliance
Does GitHub's October 2026 retention change affect audit evidence?
GitHub now applies its retention setting to checks, runs and statuses as well as logs and artifacts. Check it before an audit window outruns it.
Oct 19, 20263 min read
Compliance
Which approvals come before a security tool trial in a regulated firm?
Before a security tool trial in a regulated firm, clear data, vendor risk, access and legal approvals. This checklist shows who to ask and what to bring.
Oct 19, 20264 min read
Compliance
How do you write a gap statement when the honest answer is no?
When the honest answer to a security question is no, a gap statement keeps the deal alive. A four part template with a dated plan and an interim control.
Oct 19, 20264 min read
Compliance
How do you turn an audit finding into a ticket that closes?
Turn each finding into a ticket with a root cause, a fix, an owner, a date and proof of closure. A repeatable template for engineering leads.
Oct 19, 20263 min read
Compliance
Why freeze a dated license inventory snapshot when a deal is signed?
A dated, hashed snapshot of your SBOM and license inventory fixes what you disclosed at a point in time. Here is how to take and store one safely.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.