Application Security
Android application security best practices
A practical, evidence-based guide to Android app security: data storage, network hardening, SDK risk, and CI/CD signing, with concrete CVEs and stats.
Apr 29, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDevSecOps
start-server-and-test: Reliable E2E Test Startup in CI
start-server-and-test starts your app, waits until a URL responds, runs your tests, then tears the server down. Getting its wait semantics right is the difference between stable and flaky CI.
Apr 29, 20267 min read
Cloud Security
CNAPP vs CSPM: what's the difference
CSPM checks cloud configs, CNAPP consolidates workload security -- neither verifies what's inside your software. Safeguard vs Trivy (Aqua), compared.
Apr 29, 20268 min read
Concepts
What is a Trusted Publisher (PyPI and npm)
A trusted publisher lets your CI workflow publish packages with short-lived OIDC tokens instead of stored API keys. Here's how it works on PyPI and where npm stands.
Apr 29, 20267 min read
Open Source Security
Securing mobile app dependencies: CocoaPods and Gradle
CocoaPods and Gradle power millions of mobile apps. See how orphaned pods, build-script RCE, and dependency confusion put them at real risk today.
Apr 29, 20267 min read
AppSec
com.fasterxml.jackson.databind: Maven Coordinates, Modules, and Version Strategy
com.fasterxml.jackson.databind is the Java package, not the Maven groupId, and that mixup breaks builds weekly. Here are the correct coordinates, the module map, and a version strategy that survives audits.
Apr 29, 20266 min read
Container Security
OSS container image scanning tools compared
Trivy finds CVEs fast and free. Safeguard compares how each handles fleet-wide inventory, triage, policy enforcement, and audit evidence at scale.
Apr 29, 20267 min read
Open Source
xmldom Is Deprecated: Vulnerabilities and Migration Options
The npm xmldom package was replaced by @xmldom/xmldom years ago, yet the old name still sits in countless lockfiles with unfixed advisories. Here is how to find it and migrate.
Apr 28, 20266 min read
Open Source
date-fns-tz: Time Zone Handling and Package Health Review
A practical review of the npm date-fns-tz package: how it handles IANA time zones, how healthy the project is, and when date-fns v4's built-in time zone support replaces it.
Apr 28, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.