Security Guides
Gradle dependency verification failed: what should you do?
A Gradle verification failure means checksum or signature data did not match. Four failure types, real compromise or routine gap, and the fixes.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What is GPLv3 Installation Information for devices and signed builds?
GPLv3 section 6 asks device makers to give users what they need to install modified software. The GNU FAQ explains signed builds and remote attestation.
Oct 19, 20264 min read
Security Guides
Can you ship GPL software next to proprietary software?
Shipping a GPL program beside your proprietary one can be fine if they are separate programs. The GNU FAQ explains where the line sits and what to check.
Oct 19, 20264 min read
Security Guides
Does GPL JavaScript on your website need a source release?
Running GPL code on your server is not distribution, but JavaScript sent to browsers is. The GNU FAQ explains why the source must reach those users.
Oct 19, 20264 min read
Security Guides
What does Google restricted scope verification tell you about an app?
Apps that use Google restricted scopes can face verification and an annual third-party security assessment. See what that means and what it does not cover.
Oct 19, 20264 min read
Security Guides
Google ADC on a laptop: user login or a service account key file?
For local development with Application Default Credentials, Google lists service account keys as a risk. See the search order and a safer local setup.
Oct 19, 20264 min read
Security Guides
Which golden path checks should block, warn or only inform?
A decision table for sorting dependency checks into block, warn and inform in a golden path, with rules for promoting a check and handling exceptions.
Oct 19, 20264 min read
Security Guides
What should you set in a Go tls.Config for a service?
For most Go services, set tls.Config MinVersion explicitly, leave CipherSuites nil, and never ship InsecureSkipVerify. Here is what each field does.
Oct 19, 20264 min read
Security Guides
A dependency review checklist for a repo with Go, Rust and C++
A single checklist for pull requests that touch dependencies in Go, Rust or C++: what file changes, what to read, and what each ecosystem can hide.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.