Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Read headers from a file with curl -H @file or use a netrc file, so the token stays out of shell history. Know what each approach does and does not hide.
Name an endpoint in Reporting-Endpoints, point report-to at it, and read the JSON reports. Setup steps, report fields and the report-uri fallback.
A CSP meta tag works for client-rendered apps without header control, but it lacks features like report-only mode and report-to. See what to use instead.
OpenVEX or the CSAF VEX profile for a vendor: required fields, effort, tooling fit and when to publish both. A practical comparison for response teams.
CSAF 2.0 defines seven note categories, from summary to legal_disclaimer. What each is for and how to map them to a human readable security advisory.
How CSAF 2.0 tracks advisory status and version: draft versus final, integer versioning, and why version 0 must be a draft. A short practical guide.
Create a Jira issue from a CI job by calling the Jira Cloud REST API with an API token held as a secret. Steps, field gotchas and guardrails.
A practical way to measure how many packages came in through AI assisted commits, using git history, commit trailers and manifest diffs, with caveats.
The packageManager field in package.json pins yarn, npm or pnpm for a project, with an optional hash for validation. How Corepack works and its limits.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
