Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Line coverage shows which code ran in tests, not whether it was checked for abuse. Learn what coverage can and cannot say about security, and what to add.
SRI works on script tags and on link tags for stylesheets, preload and modulepreload. See what to hash on a store, and how the strongest hash gets chosen.
Semver build metadata is ignored when comparing versions, so 1.4.0+hotfix1 is the same version as 1.4.0 to tools. Bump the patch number instead.
SBOM generation costs seconds on a lockfile and more on a large image. Measure it per job, set a budget, and decide what runs on every commit.
Docker's registry-mirrors setting mirrors Docker Hub only. Docker says another registry cannot be mirrored that way, so plan those pulls separately.
Pip still verifies hashes when it installs from its cache of locally built wheels. Here is how that works, and where the cache can still surprise you.
%pip install changes the notebook kernel's environment but leaves no manifest. How to turn notebook installs into a pinned file that you can scan.
By default npm omits dev dependencies only when NODE_ENV is production. Learn how the omit setting shapes your SBOM and how to produce a runtime only file.
npm audit asks your configured registry for advisories. Whether it works through a mirror depends on what the mirror forwards. How to test it quickly.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
