Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Add GitHub's attest action to a workflow, verify with gh attestation verify before deploy, and know what a signed build record does and does not prove.
Install the CycloneDX Composer plugin, run make-sbom against an installed project, validate the output and run composer audit. Commands, flags and pitfalls.
Build the SBOM from pubspec.lock for the exact Dart versions, then add the native iOS and Android dependencies a Flutter app also ships. Verify the output.
Add the EEF-backed sbom Mix task as a dev dependency and run it to get CycloneDX output. Includes the dev-only rule, what it misses, and CI steps.
Pick the source that matches reality: the installed environment, a pinned requirements file, Poetry or Pipenv. See how the open source tool handles each.
For Gradle-based Kotlin builds, the CycloneDX Gradle plugin writes a JSON or XML SBOM with one task. Setup, outputs, multi-module notes and checks to run.
Use an app, mod or bin SBOM depending on whether you want what is compiled, what the module requires, or what a binary contains. Steps and trade-offs.
C and C++ have no single package manager, so SBOM quality depends on how you manage dependencies. Conan makes it easy. Vendored code needs manual records.
RubyGems uses the pessimistic operator and Gemfile.lock, npm uses caret and tilde ranges with package-lock. Know the bounds before you trust an update.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
