Compliance
Do we need a CLA for our company's open source project?
A CLA is not automatic for open source. Four cases where an extra contributor agreement helps, and when a DCO sign-off or the license alone is enough.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Do third-party SDKs in a children's app count as your data collection?
Under FTC guidance and Google Play Families policy, data an SDK collects in your child-directed app is treated as yours to answer for. What to check.
Oct 19, 20264 min read
Compliance
Do lockfiles count as SOC 2 change management evidence?
A committed lockfile records exactly which dependency versions shipped. Here is what it proves for SOC 2 change management, and what it does not.
Oct 19, 20264 min read
Compliance
Did a free pilot or demo need a federal secure software attestation?
M-23-16 exempted free, publicly available software but kept pilots of otherwise paid products in scope. What that meant, and how to think about it now.
Oct 19, 20263 min read
Compliance
Do dev dependencies and build tools count in SOC 2 scope?
Dev dependencies rarely ship to customers, but they run on laptops and in CI with credentials. Here is how to scope them in SOC 2 without boiling the ocean.
Oct 19, 20264 min read
Compliance
Do routine dependency upgrades need change tickets in a regulated team?
Not every library bump needs a manual ticket. Define which changes are controlled, and let pull request and pipeline records count as the change record.
Oct 19, 20264 min read
Compliance
A developer changes teams: how do you stop access creep?
When a developer moves teams, confirm what access is still needed, change it, and notify the right roles. NIST SP 800-53 PS-5 describes the same steps.
Oct 19, 20264 min read
Compliance
How do you describe a security gate in a customer questionnaire?
A questionnaire asks if builds are blocked on vulnerabilities. How to describe a gate rule truthfully, with reachability, overrides and its limits.
Oct 19, 20264 min read
Compliance
Which dependency metrics should you track for a SOC 2 audit?
Track five dependency numbers monthly: coverage, open findings by age, time to fix, exceptions and update lag. Each ties to a control an auditor tests.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.