Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Scaffold with Yeoman, run it in the Extension Development Host, add a command in package.json, then lock down dependencies, permissions and publishing.
Attackers publish or hijack packages so a normal install runs their code. Learn the four common routes and the checks that catch them before a build.
Go modules are published by tagging a version, and the checksum database guards consumers. See what it proves, what it misses, and where provenance fits.
Check the module's vulnerability record with govulncheck, read its retractions and deprecations, review who it pulls in, and pin the result in go.sum.
Use an id_tokens entry with aud sigstore for Cosign keyless signing, enable runner metadata for SLSA provenance, and verify with a pinned identity.
A merge request can edit .gitlab-ci.yml and run code near your secrets. Protect variables, read CI changes before running, and limit fork pipelines.
Pin GitLab CI includes and components to a commit SHA or exact release, pin images by digest, and treat moving references like latest as unreviewed code.
Set the default GITHUB_TOKEN to read only, grant write per job, pin actions to commit SHAs and use OIDC for cloud access. Here is the order to do it in.
Keep untrusted pull request code away from secrets. Avoid pull_request_target checkouts, pass event data via env vars, use read-only tokens, pin actions.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
