Developer Tools
Can I follow a GitHub project's releases in an RSS reader?
Yes. Add /releases.atom to a repository URL to get an Atom feed of its releases, then route it to a reader or chat channel for dependency watching.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Why does a GitHub attestation workflow need id-token and attestations?
GitHub's artifact attestation workflow asks for id-token, contents and attestations permissions, plus packages for images. Here is what each one is for.
Oct 19, 20263 min read
Developer Tools
What GitHub permissions should a security scanner get?
A scanner should get the least GitHub access that works. Here is how to review requested app permissions, stage them, and limit which repositories it sees.
Oct 19, 20264 min read
Developer Tools
How should you run a GitHub App for automation safely?
GitHub App installation tokens expire after one hour. How to scope permissions, store the private key, verify webhooks and narrow tokens to fewer repos.
Oct 19, 20263 min read
Developer Tools
How do I search the GitHub Advisory Database for one ecosystem?
Use search qualifiers such as ecosystem:npm, severity:high, type:reviewed and is:withdrawn to narrow the GitHub Advisory Database to what matters.
Oct 19, 20263 min read
Developer Tools
How do you query the GitHub Advisory Database REST API by package?
The global security advisories endpoint filters by ecosystem, CVE, severity, CWE and package, and returns reviewed advisories by default. Here is how.
Oct 19, 20264 min read
Developer Tools
GitHub Actions is removing Node 20: which of your workflows need a check?
GitHub's changelog says Node 20 is removed from Actions runners on 23 September 2026. How to find actions in your workflows that still declare it.
Oct 19, 20264 min read
Developer Tools
How do you harden GitHub Actions for SOC 2 change management?
Your CI workflow is part of the path to production. Pin third-party actions, trim token permissions and protect branches to make the pipeline auditable.
Oct 19, 20264 min read
Developer Tools
Can a GitHub Actions deploy wait for an external security check?
GitHub custom deployment protection rules let an app approve or reject a deploy. How they work, their limits and what a security check should return.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.