Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
The prop-types npm package is a runtime type checker React split out years ago. React 19 stopped honoring propTypes internally, which changes when and why you should still depend on it.
From the tj-actions/changed-files hijack to PyTorch's self-hosted runner breach, real incidents show how GitHub Actions workflows keep getting exploited.
A side-by-side look at signature-based malicious package detection (like Endor Labs) versus behavioral analysis, using real npm attack timelines from Shai-Hulud to chalk/debug.
To create an npm module you need package.json, a clear entry point, and a publish step, but doing it safely means locking down metadata, tokens, and what actually ships. Here is the full walkthrough.
react-native-gesture-handler is a core, actively maintained library, but any native module changes your app's trust and update calculus. Here is the security review.
Self-hosted GitHub Actions runners trade GitHub's ephemeral isolation for persistent infrastructure access — here's how real incidents like CVE-2025-30066 exploited that gap.
A Java vulnerability scanner inspects your dependencies, bytecode, and running app for known CVEs and insecure patterns. Here is how each type works.
Only 14% of packages compromised since npm launched Trusted Publishing use it. Here's how OIDC-based publishing works, why adoption lags, and what still gets missed.
Safeguard launches its MCP Server, bringing software supply chain security directly into AI-powered development workflows through the Model Context Protocol.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
