DevSecOps
How to Install Ruby on Mac: A Practical, Secure Setup Guide
The right way to install Ruby on a Mac is with a version manager, not the system Ruby. Here is a clean setup for current Ruby and even legacy 2.7 projects.
Apr 4, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Agentic Procurement: Letting AI Agents Buy Software Safely
Agents can now evaluate, trial, and pay for software without a human in the loop. The controls that make that safe: spend caps, allowlists, verifiable merchants, and audit trails.
Apr 4, 20266 min read
Software Supply Chain Security
What is Software Supply Chain Security
SolarWinds, Log4Shell, and XZ Utils show why software supply chain security now spans code, dependencies, and build pipelines alike.
Apr 4, 20267 min read
AppSec
XSS Attack Examples: How Cross-Site Scripting Works and How to Stop It
Walk through realistic XSS attack examples across the three main flavors of cross-site scripting, then see how to detect and remediate each one.
Apr 4, 20266 min read
Buyer's Guides
Chainguard pricing model and total cost of ownership
Chainguard's pricing is quote-based and centers on hardened base images. Here's how to model the real total cost of ownership, and where full-chain coverage fits in.
Apr 4, 20268 min read
Threat Intelligence
Lazarus Financial Sector Campaigns 2024-2025
Lazarus Group's 2024-2025 financial sector campaigns combined exchange compromises, DeFi exploits, and developer social engineering. Here is what defenders must know.
Apr 4, 20268 min read
AppSec
SCA Vulnerabilities: How to Find and Fix Them in Your Dependencies
SCA vulnerabilities are known security flaws in the open-source packages your app pulls in. Here is how to detect them, cut the noise, and fix the ones that matter.
Apr 4, 20267 min read
Supply Chain
What package-lock.json Does and Why You Should Commit It
The main package-lock.json use is pinning your entire npm dependency tree to exact, integrity-checked versions so every install is reproducible. Here is what is inside it and why deleting it is a bad habit.
Apr 4, 20266 min read
Software Supply Chain Security
What is a Software Supply Chain Attack
A software supply chain attack compromises trusted dependencies or build systems to spread malicious code downstream — here's how it works, and how to stop it.
Apr 4, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.