Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CPU, connection counts, process liveness and log volume are all proxies that decouple from reality in exactly the case you are trying to detect. One timestamp fixes it: when the last unit of work completed.
A timeout kills a process and loses its buffered output, so a suite that needed eleven minutes looks exactly like a deadlock. How to tell them apart, the defaults that catch people, and why a killed scan must never count as a pass.
An urgent fix gets made on the build host, the backport never happens, and the repository copy becomes a historical document. Absent files prompt questions; stale ones answer them wrongly.
SIGKILL after a ten second grace period destroys a twenty minute job and leaves its row marked RUNNING forever. Three drain strategies, the four ways they get undermined, and what to tell the user when one is lost anyway.
Most badly behaved security gates are correctly configured checks in the wrong position. The four places a check can run, what each can afford, and the rollout sequence that keeps a gate alive.
Blocking a credential at git push is genuinely good and solves exactly one half of the problem. The other half is every commit you have ever made, and deleting those commits is not the fix either.
The npm-cli-login package automated interactive npm login for CI pipelines — a pattern that npm's 2025 authentication overhaul has made both broken and unnecessary. Here is what to use instead.
A poisoned VS Code extension was live for eighteen minutes. In that window, auto-update pushed it into every developer environment with Nx Console installed — including a GitHub employee's device, leading to exfiltration of internal GitHub repositories. Your IDE extensions have no SBOM, no review, and a direct push channel to your engineers.
On 14 July 2026 attackers used 37 pull requests against a pull_request_target workflow to steal the asyncapi-bot token, then let npm's OIDC trusted publisher automatically ship the malicious release. Four packages, 2.25 million weekly downloads, four hours live — and no code review was bypassed, because none was required.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
