Open Source Security
What is Open Source Software
Open source software now sits in 96% of codebases. Here's what OSS actually is, how licensing works, and where the real security risk hides.
Feb 9, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIncident Analysis
xrpl.js npm Backdoor April 2025 Incident Analysis
A stolen Ripple-adjacent npm token pushed key-stealing versions of xrpl.js. Timeline, payload structure, and what XRPL integrators should do next.
Feb 9, 20267 min read
Incident Analysis
How to configure SIEM alerting rules
A step-by-step guide to configure SIEM alerting rules: from use case development through Splunk alert configuration to detection rule tuning.
Feb 9, 20268 min read
Open Source Security
Open Source Dependency Health Metrics That Actually Matter
Star counts and download numbers tell you popularity, not health. The metrics that predict dependency risk are harder to measure and more important to track.
Feb 8, 20266 min read
Architecture
Monorepo Security: Dependency Management at Scale
Monorepos centralize code but create unique security challenges. Learn how to manage shared dependencies, enforce security policies, and maintain SBOMs across a monorepo architecture.
Feb 8, 20268 min read
Compliance & Regulations
Federal SBOM Mandate: Compliance Deadlines and What They Mean for Vendors
Federal agencies are tightening SBOM requirements for software suppliers. Here's what vendors need to know about compliance deadlines, attestation requirements, and practical implementation.
Feb 8, 20265 min read
Open Source Security
npm Scripts Sandboxing Techniques
Postinstall scripts have been the supply-chain attacker's favorite tool for a decade. Here are the sandboxing techniques that actually work, ranked from cheap to serious.
Feb 8, 20266 min read
Regulatory Compliance
SOX IT Controls and Software Supply Chain
SOX ITGCs are being rewritten around open-source software and build integrity as PCAOB and SEC scrutiny extends ICFR into the developer toolchain for the first time.
Feb 8, 20265 min read
Incident Analysis
Dollar Tree Third-Party Breach Impacts Nearly 2 Million Employees
In November 2023, Dollar Tree disclosed that a breach at its third-party service provider Zeroed-In Technologies exposed the personal data of nearly 2 million current and former employees, highlighting the persistent risk of third-party supply chain compromises.
Feb 8, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.