Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Generate the SBOM from the resolved dependency graph, not from build.sbt. What to capture for Scala, Java and cross-built artifacts, and how to check it.
Use npm sbom or the CycloneDX npm tool on an installed or locked tree, omit dev dependencies for shipped builds, then validate and store the file per release.
Restore NuGet packages, commit a lock file, then run an SBOM generator like the CycloneDX .NET tool or sbom-tool in CI and archive the output.
Secure the pipeline and put checks inside it. Use OWASP's CI/CD risk list, scoped credentials, pinned dependencies and gates that fail on policy.
Cloud sprawl comes from easy provisioning and weak ownership. Find every account and resource, tag owners, set expiry and review monthly. A method.
Containerize a Python app with a multi-stage build, a pinned base image, hashed requirements, a .dockerignore file and a non-root user. Example inside.
Choosing a Python base image means weighing size, libc, support window and patch cadence. A decision guide with a constructed example and pinning advice.
Software licenses set what you may do with code you depend on. Learn what SPDX identifiers say, what counts as open source and how to inventory licenses.
Commit the lock file, install with npm ci, audit on a schedule, update in small batches and verify provenance. A practical routine for npm projects.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
