Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Evidence identity records how a tool decided a component's purl, name or version, with techniques and a 0 to 1 confidence. How to use it in review.
An empty dependsOn means the component has none. A component missing from the graph may have unknown dependencies. How to read the graph and mark gaps.
The CycloneDX dependencies block lists each component's direct dependencies by bom-ref. Learn to read it, and why a missing entry does not mean no dependencies.
Use library for reusable third-party code, framework when it has framework traits, and application when unsure. See the CycloneDX type values explained.
Environmental metrics let you adjust a CVSS score for your own systems using security requirements and modified base metrics. Here is what each one does.
UI:R in a CVSS 3.1 vector means someone other than the attacker must act first. It lowers the score but rarely makes a finding safe. How to weigh it.
A CVSS score rates severity, not your risk. How to explain the difference to customers in a security advisory, with wording and a short checklist.
S:C in a CVSS 3.1 vector means the flaw can affect resources beyond the vulnerable component's own security authority. Here is how to read it in a scan.
PR in a CVSS 3.1 vector says what access an attacker needs before the exploit works: none, low or high. Learn how to read it when ranking scan findings.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
