Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A library that lags on its own dependencies passes its risk to you. How to check, what stale ranges look like, and what to do when they are pinned old.
Three ways to end active maintenance, and what each does to users, security fixes and your name. A decision guide for maintainers retiring a repo.
Ansible can check detached GPG signatures when you install a collection. Setting the keyring, the required signature count and what verification skips.
Pin Ansible collections with a version or range in requirements.yml. Roles take exact versions only. See the syntax and a review checklist for the file.
ansible-galaxy collection verify compares an installed collection with the server copy. What it catches, what it skips, and how to use it in a pipeline.
An allow list fails anything unknown, a deny list passes it. Compare both approaches for CI license gates, including the unknown license trap.
Airflow providers ship and version separately from core. Here is how to inventory them, upgrade one at a time, and check the result with pip check.
Seven common beliefs about AI supply chain risk, checked against OWASP, pip and safetensors documentation, showing which hold up and which do not.
Advisory data names ecosystems differently from the tools you type: Go, crates.io, NuGet, Packagist, RubyGems, SwiftURL, Maven. A lookup table and gotchas.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
