Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
PyPI digital attestations bind a file to a signing identity such as a trusted publisher. Here is what that proves, the limits, and what it cannot tell you.
PyPI project status markers tell you if a package is active, archived, deprecated or quarantined. What each means for your installs and what to do next.
Use a package URL for open source packages and add a CPE when a database matches on it. What each identifier names and why matching goes wrong.
CI caches are restored without signature checks, so a poisoned cache can outlive the fix. When to delete caches, how scope works, and how to rebuild clean.
The OSV schema needs only an id and a modified time, then affected ranges with introduced and fixed events. What vendors must get right for scanners.
Public SBOMs build trust but expose your component list. Compare public, gated and on-request sharing, then pick by product type, customer base and effort.
Publishing from CI with trusted publishing avoids stored tokens, while laptop publishing with 2FA keeps a human in the loop. How to choose for a project.
A build log is a human readable record. Provenance is a signed, structured claim tied to an artifact digest. Why one cannot replace the other.
Match deployed image digests and release records to the build SBOM and install logs. Declared in a lockfile is not the same as running in production.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
