Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Reference remote Tekton tasks by commit SHA or bundle digest through resolvers, switch off resolvers you do not use, and verify signatures with trusted resources.
Sign TeamCity build artifacts with a key the build steps cannot read, ship a provenance record, and verify both before deploy. Here is what SLSA expects.
TeamCity plugins can reach everything on the server. Learn how JetBrains says to install them, how to hold a version and how to review plugin changes.
Supply chain attacks hit source, build, dependencies and registries. The SLSA threat model lists eight integrity threats, each with a matching control.
US federal rules loosened, SBOM guidance tightened, EU dates arrived and two package hijacks hit in March. Here is what changed and what to do next.
Manage software supply chain risk by tiering suppliers, keeping an inventory, controlling what enters builds, asking for evidence and planning for failure.
Teams often feel ready for supply chain attacks without testing it. Use six evidence-based questions to turn a feeling into a measured readiness score.
Provenance records who built an artifact, how and from what inputs. How SBOMs, SLSA provenance and in-toto fit together, and a practical way to start.
Attackers now target how software is delivered, not written. See how xz and KICS show the gap between reviewed source and installed code, and close it.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
