Open Source Security
PyPI 2FA Lessons Two Years In
PyPI mandated 2FA for all maintainers in 2024. Two years in, account takeovers dropped — but attackers shifted to OIDC tokens, abandoned packages, and maintainer devices.
Mar 6, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDevSecOps
What is Code Signing
Code signing proves who published software and that it wasn't tampered with — but SolarWinds, CCleaner, and 3CX show signed doesn't mean safe.
Mar 6, 20266 min read
Supply Chain Security
GitHub Actions Artifact Poisoning: A Growing Supply Chain Attack Vector
Researchers disclosed techniques to poison GitHub Actions artifacts, enabling code execution in CI/CD pipelines of downstream projects. The attack exploits trust assumptions in artifact sharing.
Mar 6, 20267 min read
Best Practices
How to Detect Malicious npm Packages: A Workflow
A practical detection workflow for malicious npm packages: install-time signals, registry heuristics, reachability checks, and CI gates that actually block attacks.
Mar 6, 20267 min read
Buyer's Guides
Hyperproof alternatives and review
Hyperproof and Sprinto automate compliance workflows, not supply chain security. Here's the concrete difference — and where Safeguard's SBOM, SAST/DAST, and scanning fit in.
Mar 6, 20267 min read
Best Practices
Procurement Security Questionnaires That Actually Work
How to design a supplier security questionnaire that produces usable signal, what to cut from standard templates, and how to integrate the output into real risk decisions.
Mar 6, 20267 min read
Product
Safeguard Desktop App 1.0 Release
The Safeguard desktop application is 1.0 on macOS, Windows, and Linux. It brings the full workflow engine, Local Runner, and offline posture reviews to developers.
Mar 6, 20267 min read
Open Source Security
OSS Trademark Policies: Security Angle
Trademarks matter in open source security because they are the signal of authentic origin. When trademark policies fail, typosquatting, impostor forks, and compromised builds follow.
Mar 6, 20267 min read
Compliance
FedRAMP Continuous Monitoring: What ConMon Really Involves
Authorization is the starting line. FedRAMP ConMon means monthly scans, POA&M hygiene, 30/90/180-day remediation clocks, and an annual assessment — every year, forever.
Mar 6, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.