Open Source Security
How to Publish an npm Package With Provenance
A step-by-step tutorial for publishing npm packages with provenance attestations so your consumers can cryptographically verify the build source.
Feb 16, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDevSecOps
CI/CD Compromise Investigation Steps
A step-by-step investigation playbook for suspected CI/CD pipeline compromise, from runner forensics to secrets rotation.
Feb 16, 20266 min read
Application Security
Certificate Pinning for Software Updates: When and How to Pin
Certificate pinning can protect your update channel from MITM attacks, but it introduces operational complexity. Here is when pinning makes sense and how to do it safely.
Feb 16, 20264 min read
Security Management
Security KPI Frameworks: Measuring What Matters Without Drowning in Metrics
Most security metrics measure activity, not outcomes. Here is how to build a KPI framework that tells leadership whether the security program is actually reducing risk.
Feb 16, 20265 min read
Application Security
Mobile Application Security Testing: Beyond the OWASP Mobile Top 10
Mobile apps have unique security challenges that web-focused tools miss entirely. Here is a practical testing methodology for iOS and Android.
Feb 16, 20266 min read
Licensing
GPLv3 License: What Changed From GPLv2
GPLv3 added patent protection and anti-tivoization clauses that GPLv2 never had. Here's what actually changed and why it still matters for dependency compliance.
Feb 16, 20265 min read
Licensing
The AGPL-3.0 License, Explained
AGPL-3.0 is the GNU Affero General Public License v3.0 — GPLv3 with one added clause that closes the SaaS loophole, requiring source disclosure even when software is only used over a network, never distributed.
Feb 16, 20266 min read
Container Security
Kubernetes Secrets Encryption Providers Reviewed
etcd encryption at rest finally works out of the box. The question is which provider you use, and the trade-offs have sharpened in 2024.
Feb 16, 20268 min read
Regulatory Compliance
Fintech Software Supply Chain Regulatory Map
A practical tour through the tangle of regulations, supervisory letters, and industry standards that now govern how fintech firms build, buy, and operate software.
Feb 16, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.