Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
plugin.path lists directories of connectors, converters and transformations that a Connect worker loads. Whoever writes there controls code in the worker.
Use OpenSSF Scorecard checks such as Maintained, Code-Review, Signed-Releases and Vulnerabilities as a quick triage, then read what the scores cannot say.
Spring Boot 3 moved to Jakarta EE 10 and jakarta packages. What changed in coordinates and imports, and how leftover javax artifacts show up in scans.
Read the signals in an SBOM request, such as format, version, scanner and deadline, to decide whether a basic file will do or a deeper answer is needed.
Check release dates, commit activity, issue replies and archive status each quarter to decide whether a dependency needs a replacement plan.
The launcher script fetches the newest generator release on its own. What that means for repeatable builds, and how to use it safely or skip it.
The compiler is not shipped, but the runtime libraries it links are. See what belongs in the firmware SBOM and what belongs in a separate build record.
Pseudonymous maintainers are common and often fine. Judge them by track record, process and continuity, not by whether their legal name is public.
Console ports from outside companies bring their code into your game. Why to treat a porting partner like any supplier, and what to ask for and record.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
