DevSecOps
GitLab CI Security Scanning Setup
Step-by-step guide to enabling SAST, DAST, dependency scanning, and container scanning in GitLab CI pipelines.
Jan 24, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDevSecOps
GitHub Actions: SHA-Pin Tags or Get Burned
Tag-pinning Actions feels fine until a maintainer gets compromised. Here is why SHA-pinning is the only serious option in 2026 and how to operationalize it.
Jan 24, 20266 min read
DevSecOps
Ruby Brakeman Security Scanner: Rails-Aware Vulnerability Detection
Brakeman understands Rails conventions and catches security issues that generic scanners miss. Here is how to use it effectively.
Jan 24, 20265 min read
DevSecOps
Git Credential Security for Organizations: Locking Down Source Access
Git credentials are the keys to your source code. Here is how organizations should manage them to prevent unauthorized access and credential theft.
Jan 23, 20264 min read
DevSecOps
Compromised npm packages in the React and Next.js build p...
A react npm supply chain incident case study: how a phishing attack on a single maintainer compromised chalk, debug, and other build-pipeline dependencies.
Jan 23, 20268 min read
DevSecOps
Spinnaker Deployment Security
Securing Spinnaker's multi-cloud deployment pipelines with authentication, authorization, pipeline constraints, and artifact verification.
Jan 22, 20265 min read
DevSecOps
gosec: Static Analysis for Go Security
gosec is the standard security linter for Go. Here is what it catches, what it misses, and how to integrate it effectively into your workflow.
Jan 22, 20265 min read
DevSecOps
SBOM Sharing and Distribution Best Practices
Generating SBOMs is only half the battle. Sharing them securely and effectively with stakeholders requires careful planning and tooling.
Jan 22, 20266 min read
DevSecOps
Git Hooks as Supply Chain Controls in 2026
Server-side and client-side git hooks are an underused control surface for supply chain risk. Here is what to enforce, where to enforce it, and what to leave alone.
Jan 22, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.