Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
OWASP CICD-SEC-10 warns that attacks on build systems go unseen without logs. Inventory every system, enable audit and app logs, and centralize them.
OWASP CICD-SEC-1 covers pipelines where one person or bot can ship code to production unreviewed. See the abuse paths and the controls that close them.
Cargo.lock fixes the exact versions you build, caret ranges allow upgrades, and yanking has limits. Learn how to pin, update and handle a bad release.
C and C++ have no single package registry, so pinning is on you. Use lockfiles, baselines, commit hashes and an SBOM so you can patch what ships.
Signed pipelines make agents refuse tampered steps, but they do not sign your build artifacts. Here is what the signature covers and how to add the rest.
Buildkite plugin tags can move. Pin plugin versions to a commit SHA, restrict plugin sources on the agent, and review every update before it ships.
Buildkite has API access tokens, agent tokens and OAuth CLI tokens. Scope each one, set expiry and IP limits, and keep agent tokens out of job workloads.
Image risks come from vulnerabilities, bad configuration, embedded secrets and untrusted sources. Build and verify images using NIST SP 800-190.
In Bitbucket Pipelines, sign artifacts with a protected key and use the step OIDC token for identity. Self-written provenance reaches SLSA level 1 only.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
