Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
SLSA hardens how software is built and proves it with provenance. NIST SSDF covers the whole secure development practice. See the overlap and which to use.
Slopsquatting is registering package names that AI tools invent. Mitigate with a registry proxy, package review, agent install limits and reserved names.
Rekor is Sigstore's append-only transparency log for signing records. Learn what it stores, what it proves, and how to check that an artifact was logged.
AI adds models, datasets and tools to your supply chain. Extend SSDF practices to them: inventory, provenance, pinning, review and a clear owner for each.
Build Java images with multi-stage builds, a slim pinned base, a non-root user and a dropped-privileges runtime. Then scan the dependencies inside the jar.
Commit composer.lock, deploy with install not update, run composer audit in CI, and skip dev packages in production. A short checklist for PHP teams.
Pin exact versions in sbt, control resolvers, watch cross-built artifact names, review evictions and scan the resolved tree, not just build.sbt.
An SBOM lists what is inside software. An attestation is a signed claim about how it was built or checked. See what each proves and how to use both.
A constructed case of an old fielded system and a new library flaw shows what an SBOM answers in the first hour and what it leaves open. Test yours.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
