Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Use pipx for command-line tools and pip inside a project environment for libraries. Here is why isolation matters and how to choose in a few seconds.
Download your Python dependencies once, then install from that folder with the index disabled. Steps, platform pitfalls and how to keep the folder honest.
Installing a Python wheel unpacks files. Installing from source runs the project's build code first. Here is how to choose and how to limit the risk.
Pinning the runtime keeps laptops, CI and production aligned. How npm engines, .NET global.json and Go go.mod lines behave, and where they fall short.
Pin job images by SHA digest, install exact tool versions with checksums, and use locked dependency installs. A short checklist drawn from GitLab guidance.
Pin third-party GitHub Actions to a full commit SHA from the action's own repository. Tags can move. When a tag is acceptable and how to maintain pins.
Release tags can be moved. After the Trivy and tj-actions incidents, here is how to pin Actions to full commit SHAs without letting updates rot.
Pinning gives repeatable builds, ranges give automatic patches. How npm, Go and containers differ, and which setting a security fix PR should use.
CMake advises a commit hash for GIT_TAG when you do not control the remote, since tags can move. How to pin sources, verify archives, and build offline.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
