Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
GOINSECURE allows insecure transport for listed modules but keeps checksum checks. GOSUMDB=off removes checksum database verification. Know the difference.
Go binaries built with module support embed their dependency list and build settings. Read them with go version -m or runtime/debug to audit shipped code.
A starting checklist for a new Go service: commit go.sum, pin the toolchain, scope private modules, scan with reachability, and gate pull requests.
Go has no license field. Tools find licenses by reading LICENSE files and matching text. Learn the limits of that heuristic and how to verify it.
Use go mod why for the shortest import path and go mod graph for module edges to trace a vulnerable Go dependency to the module that requires it.
go mod verify rehashes modules in your local cache and flags any that changed since download. See what it covers, what it does not, and where to run it.
Go is called memory safe, yet its memory model says races on slices, maps, strings and interfaces can corrupt memory. Here is what to do about that.
Automatic forwarding is on by default in Google Workspace. How to limit it to internal addresses, what filters can still do, and how to check it.
GitLab has three secret detection modes that act at different moments. See what each one catches, when it fires, and how to combine them in practice.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
