Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Components add versions and typed inputs, but GitLab says it cannot vouch for third-party ones. How to pin to a SHA, review updates, and avoid latest.
By default GitLab keeps separate caches for protected and unprotected refs. Why, what the key suffix means, and when turning separation off is unsafe.
A release workflow needs only the permissions its job uses. Set a permissions block per job, add id-token only where needed, and default the rest to none.
A temporary private fork lets you fix a flaw privately, but CI does not run, pull requests merge together and branch protection is skipped. Plan for it.
How GitHub rulesets combine with each other and with branch protection, who can be on a bypass list, and how to keep exceptions small and visible.
For most integrations a GitHub App is the safer shape: narrower permissions, chosen repositories and one hour tokens. When an OAuth app still fits.
Path filters can run a scan only when a package changes, but a skipped workflow leaves required checks pending. Learn a safe pattern for required checks.
A step by step nightly scan workflow: cron off the top of the hour, a manual trigger, a concurrency guard and a rule for what fails the job.
A plain clone leaves submodule folders empty, so a scan sees nothing inside them. Learn how to initialise submodules in CI and decide scan ownership.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
