Software Supply Chain Security
What is Sigstore
Sigstore lets projects sign software with short-lived, identity-bound certificates instead of long-lived keys. Here's how Fulcio, Rekor, and Cosign actually work.
Mar 6, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAppSec
SAST Full Form and What It Actually Tests
SAST stands for static application security testing — analyzing source code without running it. Here's exactly what it catches, what it misses, and how it fits a pipeline.
Mar 6, 20265 min read
Vulnerability Analysis
CVE-2024-32002 Git RCE on Clone: Walkthrough
CVE-2024-32002 is a Git submodule RCE triggered by a recursive clone on case-insensitive filesystems. Root cause, exploit, and remediation.
Mar 6, 20269 min read
Industry Analysis
Software Supply Chain Security Market Map 2026
A senior-analyst market map of software supply chain security in 2026: the vendor categories that consolidated, the ones that splintered, and where the budget actually lands.
Mar 6, 20269 min read
Compliance
Vulnerability management and scanning tools
Sprinto automates compliance evidence collection; Safeguard scans code, dependencies, and containers directly. Here's how the two actually differ on vulnerability management.
Mar 6, 20268 min read
Security Concepts
What Is CWE? The Common Weakness Enumeration Explained
CWE catalogs the underlying software weakness behind a vulnerability, not the specific instance of it — here's how it relates to CVE and why scanners tag findings with a CWE ID.
Mar 5, 20265 min read
Licensing
GNU GPL v3.0 Obligations, in Plain English
The GNU General Public License v3.0 explained without the legal phrasing: what you must do when you distribute software that includes GPL-3.0 code, and what triggers those obligations.
Mar 5, 20265 min read
Vulnerabilities
CVE-2020-15250: The JUnit Temp File Vulnerability
CVE-2020-15250 shows how a test-only utility class in JUnit 4 created world-readable temp files on Unix systems, and why it still shows up in scans of projects that never touched production code paths.
Mar 5, 20264 min read
Ransomware
Rhysida Ransomware: Systematic Targeting of Government and Critical Infrastructure
Rhysida ransomware distinguished itself through deliberate targeting of government agencies, education institutions, and healthcare organizations across multiple countries.
Mar 5, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.