DevSecOps
GitHub Actions: SHA-Pin Tags or Get Burned
Tag-pinning Actions feels fine until a maintainer gets compromised. Here is why SHA-pinning is the only serious option in 2026 and how to operationalize it.
Jan 24, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSoftware Supply Chain Security
Cross-Language Dependency Analysis: Bridging npm, pip, Maven, and Beyond
Modern applications use multiple languages and package ecosystems. Analyzing dependencies across these boundaries requires techniques that single-ecosystem tools cannot provide.
Jan 24, 20266 min read
Application Security
Dynamic Application Security Testing: A Practitioner's Guide to DAST Done Right
DAST finds what source code analysis cannot. Here is how to set it up, tune it, and actually get value from it in a modern CI/CD pipeline.
Jan 24, 20267 min read
AI Security
AI Cybersecurity Glossary: Key Machine Learning & Security Terms
A defender's glossary of AI security terms — prompt injection, model poisoning, AI-BOM, adversarial ML — with dated, real-world incidents behind each one.
Jan 24, 20268 min read
Open Source Security
package-lock.json integrity checks and the npm audit work...
A step-by-step guide to verifying package-lock.json integrity, running npm audit correctly, and scanning Node.js dependencies for tampering and vulnerabilities.
Jan 24, 20268 min read
Security Culture
Cross-Functional Security Collaboration
Security isn't just the security team's problem. Building effective collaboration between security, engineering, product, and operations is essential for supply chain defense.
Jan 24, 20266 min read
Vulnerability Management
Understanding EPSS: Exploit Prediction Scoring System Explained
EPSS offers a data-driven approach to vulnerability prioritization. Learn how it works, how it compares to CVSS, and why your team should care.
Jan 24, 20266 min read
AI Security
What is Navigating AI for Source Code Analysis
AI source code analysis pairs LLMs with static analysis to cut false positives and speed triage -- but reachability data still decides what's real.
Jan 24, 20267 min read
DevSecOps
Ruby Brakeman Security Scanner: Rails-Aware Vulnerability Detection
Brakeman understands Rails conventions and catches security issues that generic scanners miss. Here is how to use it effectively.
Jan 24, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.