Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Commit composer.lock for applications so every install gets the same versions. For libraries it is optional. Here is why, and what it means for security.
A scanner has its own dependencies and runs inside your pipeline. Why to ask the vendor for its SBOM, what to look for, and what a good answer sounds like.
Dev dependencies rarely ship, so most gates should scope to runtime. When dev tools still matter, and how to set the scope in common tooling.
A front-end SBOM should cover bundled npm packages, plus scripts loaded by URL and external services. Here is what to record and which format fields help.
skopeo copy can write images to a directory or another registry and keep digests with preserve-digests and all. Steps and traps for on-prem vendors.
A decision guide for SBOM access: public, gated download, NDA or on request. Match the audience and sensitivity, and keep versions and signatures straight.
CISA and GitHub describe how the September 2025 npm worm stole credentials and republished itself through maintainers. The mechanics and the defences.
GitHub's dependency submission API accepts dependencies resolved at build time, and its docs list a Gradle action, so the graph matches real builds.
SEBI's CSCRF asks regulated entities to obtain SBOMs for critical software and new purchases. What it says, what an SBOM must hold, and vendor prep.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
