Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A GitHub Actions workflow that builds a Node.js image and pushes it to Docker Hub with an access token, least-privilege permissions and pinned actions.
Use short-lived OIDC credentials from CI instead of stored crates.io tokens, and scope and expire any token you keep. Here is the model and the checks.
Poisoned pipeline execution lets someone with repo access run commands in your CI by editing pipeline config or files it uses. See the types and fixes.
Packagist builds versions from your repository tags, so provenance starts at your repo. Learn what that means, the hook token risk and what to check.
package-lock.json pins the exact dependency tree npm installed. Commit it for apps, install with npm ci in CI, and review its diffs like code. Here is why.
NVD enriches CVE records with scores and product data; OSV maps advisories to exact package versions. See how they differ and why many scanners use both.
Open source scanners match your dependencies to public vulnerability data. Compare data sources, ecosystem coverage and false positives on your own repos.
Finding counts mislead. CISOs get a truer view from coverage, known exploited exposure, reachable flaws, time to fix and unknowns. Track these.
Maintainers owe no one a questionnaire. Publish a security policy, point to public evidence, keep one answers file, and ask the company to fund the extra work.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
