Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
AWS said a GitHub token with overly broad access in a build configuration let an attacker reach a release. Here is how to audit and shrink your own.
How OSV records affected versions with introduced and fixed events, and how to read a range to decide whether your installed version is vulnerable.
The Best Practices Badge is a self-certified checklist; Scorecard is an automated scan. Learn how they differ and how they connect in one Scorecard check.
A one page checklist for publishing an open source project: clean history, account protection, a security policy, signed releases and a plan for reports.
Beyond known CVEs: how acquirers judge the health of a target's open source dependencies using maintenance signals, review practices and replacement cost.
A VEX statement has one status and one vulnerability for its listed products. When a status differs across versions you must split it. A practical guide.
A monorepo ships many things, so one repo wide SBOM can mislead. Decide the SBOM boundary by what you deliver, and see how to generate and store them.
The referrers API lets a registry list artifacts such as signatures and SBOMs that point at an image digest. Here is how it works and what to check.
Package source mapping tells NuGet which feed each package ID may come from. Here are the nuget.config syntax, precedence rules and onboarding steps.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
