Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
npm Trusted Publishing replaces long-lived publish tokens with short-lived OIDC-issued credentials tied to a specific CI workflow. Here is the 2026 rollout state, what the migration actually looks like, and where the rough edges still are.
node-jose is Cisco's JavaScript implementation of the JOSE standards for signing and encrypting tokens. Here is the CVE-2017-16007 invalid-curve flaw and how to use JWE and JWS defensively.
Shift left fails when it means shifting friction left. Here are the DevOps security best practices that catch issues early while keeping pipelines fast enough that engineers leave the gates on.
npm provenance ties a published package to the specific GitHub Actions run that built it, signed through sigstore. Here is how to enable it for a publisher, verify it on the install side, and enforce it in CI without breaking your release process.
A security-focused comparison of Flux 2.5 and Argo CD 3.1: trust models, multi-tenancy, secret handling, signature verification, and the operational differences.
A Python URL validator has to do more than match a regex. Here is how to validate URLs safely, block SSRF, and pick between urllib, validators, and Pydantic.
The netty-codec-http2 Maven artifact powers HTTP/2 in gRPC, Spring, and countless services. Here are the CVEs that matter, the safe versions, and how to find it in your tree.
Detailed runbooks for responding to dependency CVE disclosures across languages and ecosystems, with roles, commands, and timelines tuned for automation.
The node:18-alpine image is small and popular, but Node.js 18 reached end of life in April 2025. Here is what that means for your containers and how to migrate cleanly.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
