Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Yes. Store an SBOM at build time and re-match it against fresh advisory data on a schedule. Why it works, what it misses, and how to set it up.
Reproducible builds let anyone rebuild your release and compare it bit for bit. What that needs, how far a small project should go, and where to start.
A build is reproducible when anyone can rebuild the same outputs bit for bit from the same source and instructions. Why that matters for firmware you ship.
Registering a few lookalike package names can blunt typosquats, but it cannot cover them all. What npm's naming rules say, and what else to do instead.
A rebuild test shows whether your sources, dependencies, toolchain and base images still exist. What to record per release and how to run the drill.
One npm month held 142,163 malicious records and a RubyGems month 2,540. Why feed totals mislead, and the three numbers to track for your estate instead.
Before a supplier image runs in your cluster, ask about its SBOM, patch cadence, signing, privileges and support. A checklist to send as a questionnaire.
A malicious torchtriton on PyPI beat the project's own nightly index in December 2022. How the install order allowed it and how to defend against it.
Replace a PyPI API token with a trusted publisher: the form fields, the workflow permission, and why a dedicated publish job with an environment helps.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
