Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Pin every Bitbucket pipe to an exact version, keep secrets in secured variables, and review upgrades. See why floating tags and unreviewed pipes are risky.
The xz backdoor was caught by a slow login, not a scanner. What it showed about maintainer trust and tarballs, and the checks that still help today.
Java dependency risk hides in transitive libraries. Pin versions, control mediation in Maven or Gradle, lock resolved versions and patch on a schedule.
Commit your lockfile, publish from CI with provenance or trusted publishing, and say what provenance does not prove. A short guide for package authors.
Two bad axios releases in March 2026 came from a hijacked maintainer account. What happened, what to check on your machines and which signals could help.
Secure Amazon ECR with immutable tags, the right scanning type, lifecycle rules that keep what you ship, narrow access, and a scan result you act on.
A first-year plan for automotive software teams with no program yet: inventory components, collect supplier SBOMs, set intake rules and a triage path.
Verify Argo CD's own images and CLI with SLSA provenance, enforce signed Git commits via source integrity, and use admission policy for what you deploy.
Argo CD does not build code, but its pull request generator can deploy anything a PR describes. Lock down projects, filters and who can open PRs.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
