Open Source Security
Managing Python Package Namespace Conflicts
Python's flat namespace creates real security problems. Here is how namespace packages, shadowing, and install order interact, and how to avoid the surprises.
May 18, 20246 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source Security
Rust no_std Supply Chain Considerations
Writing Rust for embedded or kernel targets drops you into no_std territory, and the supply chain rules are different there. A practical look at what changes and why.
May 15, 20247 min read
Open Source Security
The OSS Pledge: Adoption Tracking at Six Months
Six months after the OSS Pledge launch, adoption is climbing but uneven. Who signed, who followed through with funding, and what the pledge has actually shifted in open-source economics.
May 14, 20246 min read
Open Source Security
Kotlin Multiplatform Supply Chain Risks
Kotlin Multiplatform ships one codebase to JVM, iOS, Android, JS, and native targets. The supply chain surface expands in specific ways worth tracking.
May 12, 20246 min read
Open Source Security
CNCF Project Security Audits: What They Find and Why They Matter
The Cloud Native Computing Foundation funds independent security audits for its projects. The findings reveal patterns that every cloud native adopter should understand.
May 12, 20246 min read
Open Source Security
Spring Dependency Management Supply Chain
Spring Boot's dependency management is the unsung hero of the Java ecosystem, and it is also a supply chain seam worth understanding. Here is how BOMs, starters, and transitive version coercion shape what actually ships.
Apr 30, 20247 min read
Open Source Security
npm Registry Authentication Deep Dive
The npm registry supports four distinct authentication flows. Most teams use one, badly. A tour of how auth actually works, what the tokens look like, and where the model breaks.
Apr 25, 20247 min read
Open Source Security
PyPI Supply Chain Attacks: Q1 2024 Roundup
Q1 2024 brought typosquats, stealer campaigns, and a week-long new-user freeze on PyPI. Here is what the attacks looked like and how to defend.
Apr 22, 20245 min read
Open Source Security
PyPI Package Namespace Governance
PyPI's flat global namespace is one of Python packaging's oldest design decisions. How it's governed today, where the tension points are, and what the PEP 752 debate means for the future.
Apr 18, 20246 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.