Open Source Security
Dependabot Security Updates: Behavior Deep Dive
A hands-on look at how Dependabot security updates behave in 2023 - PR grouping, semver strategy, transitive coverage, and alternatives when it misses a fix.
Feb 3, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source Security
Scanning Go codebases for known vulnerabilities with govu...
A practical govulncheck tutorial for scanning Go codebases for known vulnerabilities, auditing dependencies, and wiring checks into your CI pipeline.
Feb 3, 20267 min read
Open Source Security
RubyGems supply chain attacks: gem typosquatting and hija...
A look at RubyGems typosquatting and maintainer takeovers: how malicious Ruby gems slip into the supply chain, and what actually stops them.
Feb 3, 20267 min read
Open Source Security
Pipenv Security Posture Review
Pipenv is still in production at many companies. Here is an honest look at its security model, its maintenance status, and when it is time to migrate away.
Feb 2, 20266 min read
Open Source Security
Rust crates.io Supply Chain Controls in 2026
crates.io has gained real supply chain features over the past two years. Here is an honest read on what works, what is still immature, and where to invest.
Feb 2, 20266 min read
Open Source Security
Bundler dependency pinning and Gemfile.lock as a supply c...
A step-by-step guide to Gemfile.lock security: pin gems deliberately, enforce ruby lockfile integrity with checksums, and lock down bundle install in CI/CD.
Feb 2, 20268 min read
Open Source Security
Auditing Ruby dependencies for known CVEs with bundler-audit
A step-by-step bundler-audit tutorial for scanning Ruby gems against known CVEs, patching vulnerable dependencies, and enforcing the check in CI.
Feb 2, 20267 min read
Open Source Security
Case study: RubyGems account takeover incidents and their...
A look at real RubyGems account takeover incidents, including the rest-client hijack, and what they reveal about Ruby supply chain risk.
Feb 2, 20268 min read
Open Source Security
npm Lockfile v3 Security Improvements
Lockfile v3 is more than a format bump. It quietly fixed a class of integrity bugs that plagued v1 and v2, and the difference matters more than most teams realize.
Feb 1, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.