Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Script injection runs attacker text as shell code in a workflow. See how a pull request title becomes a command and how an environment variable fixes it.
repo2docker builds an environment from files like requirements.txt. It automates good practice, but unpinned files still give different results over time.
npm keeps a hidden lockfile in node_modules and flags entries as dev, optional, link or bundled. What each means when you decide what a scan should cover.
Fickling is an open source pickle analyzer from Trail of Bits. What it does, the load time safety hook, and why an allowlist still needs a human owner.
Developer experience in security tooling is how easy it is for developers to use, trust and act on security checks. Definition, parts and how to assess.
Corepack pins the package manager a project uses through the packageManager field, with an optional hash. Why that is a hygiene step and how to set it.
Corepack reads the packageManager field so everyone on a Node project uses the same Yarn, pnpm or npm version. Learn the setup and the security upside.
An unintentional input changes build output without anyone meaning it to, like the clock, a path or a username. Here is how to find and remove them.
An incremental scan analyses only what changed since the last run. It can skip unchanged files and layers, but not re-matching against new advisories.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
