DevSecOps
NuGet Private Feed Security Hardening
Private NuGet feeds sit in the blind spot of most security programs. The hardening work is not glamorous but the failure modes are expensive.
Mar 5, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSBOM & Compliance
Cosign Verification Policies in Production
Writing cosign verification policies that actually pass production deployment gates requires more precision than the examples suggest. Here is what we have learned.
Mar 5, 20266 min read
Best Practices
Vendor Risk During M&A Due Diligence
M&A due diligence usually ignores vendor risk until the day after close. By then, the buyer has inherited a vendor portfolio with no visibility and no leverage.
Mar 5, 20267 min read
Best Practices
Tracking Vendor-Supplied Binaries In Your Runtime
Vendor binaries run as root and ship without SBOMs. Continuous discovery brings them under the same governance as your own code.
Mar 5, 20267 min read
Open Source Security
Swift And CocoaPods Supply Chain Program
A 2026 supply chain program for Swift apps — covering SPM, CocoaPods, XCFrameworks, and notarisation — anchored by Safeguard policy and SBOM evidence.
Mar 5, 20267 min read
DevSecOps
Reachability As The Bridge Between SCA And Fix PRs
SCA tools find vulnerabilities. Auto-fix tools generate PRs. The gap between them is where most programs lose efficiency. Reachability is the bridge.
Mar 5, 20263 min read
Best Practices
Post-Quantum Signing: An Artifact Migration Plan
A concrete migration plan for artifact signing from ECDSA to ML-DSA and SLH-DSA, covering Sigstore, Notary, HSMs, and staged hybrid rollouts.
Mar 5, 20265 min read
DevSecOps
Metrics Developers Care About: Secure By Default
Most security metrics are built for the security team. A guide to picking metrics that developers will actually act on, with examples from secure-by-default workflows.
Mar 5, 20268 min read
AI Security
Griffin AI vs OpenAI Assistants API for SecOps
The OpenAI Assistants API is a general agent framework. SecOps needs more than a framework — it needs the engine-grounded reasoning Griffin AI adds on top.
Mar 5, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.