Best Practices
How to Implement SLSA Level 3 Practically
SLSA Level 3 requires hardened builds, verifiable provenance, and isolated build environments. Here is the practical path, not the theoretical one.
Mar 20, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDevSecOps
DevSecOps and Platform Engineering: The Convergence No One Expected
Platform engineering teams are becoming the new home for security controls. Here's why that is both promising and risky.
Mar 20, 20266 min read
Open Source
npm underscore Security Review: Is It Safe to Use in 2025?
A security review of the npm underscore package, the code-injection CVE in its template function, and whether you still need it in a modern JavaScript stack.
Mar 20, 20265 min read
Emerging Technology
DNS Cache Poisoning for Software Updates: 2025
DNS cache poisoning is a known attack class with a new application: hijacking software update checks to ship malicious binaries that pass every signature check.
Mar 20, 20268 min read
Regulatory Compliance
ISO 27001 risk assessment methodology
A practical breakdown of the ISO 27001 risk assessment methodology under the 2022 revision, where GRC platforms like Vanta fall short, and how to build a register that survives Stage 2 audits.
Mar 20, 20268 min read
Engineering
Ruby Gems Security: Signing, Yanking and Trusted Publishing
Gem signing never took off, yanking is weaker than people assume, and trusted publishing finally fixes the credential problem. What to actually rely on in a Ruby pipeline.
Mar 20, 20266 min read
AppSec
Vuln Scan Basics: How Vulnerability Scanning Actually Works
What a vuln scan is, the main scanner types, how to read a report without drowning in noise, and how to fit scanning into a development pipeline.
Mar 20, 20266 min read
Container Security
What is Docker Security
Docker security spans image scanning, SBOMs, and runtime controls — see the CVEs, misconfigurations, and real breaches that show why each layer matters.
Mar 20, 20268 min read
Security
How Does Malicious Code Spread? A Practical Security Guide
Malicious code spreads through the channels people already trust: email attachments, infected downloads, removable media, compromised websites, and increasingly the software supply chain itself.
Mar 20, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.