Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Configure npm trusted publishing with the exact repo, workflow filename and environment. Check CLI version, the repository field and the 2 day expiry.
npm staged publishing lets CI stage a release while a maintainer approves it with 2FA. What the commands do, the requirements, and when it is worth using.
Publish with npm provenance from GitHub Actions: grant id-token write, use a hosted runner, match the repository field, and use the provenance flag.
optionalDependencies let an install continue when a package fails to build. Learn the override rule, how to skip them, and what they mean for scanning.
The files field is an allowlist for your npm tarball and beats a root .npmignore. See what is always included or excluded, and how to avoid leaking files.
The latest dist-tag is what npm installs when you give no version, and publishers can move it. Learn what that means for installs, pinning and response.
npm's Require two-factor authentication and disallow tokens setting blocks token-based publishing. What it changes, what it keeps, and when not to use it.
bundleDependencies packs dependency code inside your tarball instead of resolving it at install. Learn how it works and why it can hide parts from scans.
Suppliers often link to a sub-component's own SBOM instead of inlining it. Here is how to resolve external references safely and keep the chain intact.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
