Security Guides
How do you verify your own release the way a user would?
After you publish, download your release fresh and verify it: checksum, signature identity, attestation and a clean install. A five step routine.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Verify a data request without collecting more personal data
How to confirm who is making a GDPR request, using what you already hold, without asking for passports and creating a bigger privacy problem.
Oct 18, 20263 min read
Security Guides
Verify GitHub's SSH host key the first time you connect
When SSH asks whether to trust GitHub's host key, compare the fingerprint against the published list, or pre-load known_hosts in CI instead of typing yes.
Oct 18, 20263 min read
Security Guides
How to verify an APK signature with apksigner
Use apksigner verify with the print-certs option to check an APK signature and compare the signing certificate to the one you expect before sideloading.
Oct 18, 20263 min read
Security Guides
How to verify a Windows installer signature with SignTool
Run SignTool verify with the default authentication policy to check an installer signature, read the publisher and spot a missing timestamp. Steps.
Oct 18, 20263 min read
Security Guides
Why do license scanners miss vendored code and git submodules?
Copied-in code and submodules sit outside manifests, so scans can skip them. Learn where the blind spots are and how to inventory and scan what you ship.
Oct 18, 20263 min read
Security Guides
What if a vendor will not patch a vulnerability? Accept, replace or wrap
When a supplier will not or cannot fix a flaw, you have three paths: accept with controls, replace the product, or wrap it. How to choose and record it.
Oct 18, 20263 min read
Security Guides
How can you review a new vendor's security in one week?
A day by day plan for a proportionate vendor security review when a team needs an answer fast: scope, evidence, gaps, decision and a record.
Oct 18, 20263 min read
Security Guides
What should a vendor risk register record for each supplier?
A vendor risk register works when each row shows the owner, what the vendor touches, the evidence you hold and the review date. Here are the fields to use.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.