A practical course on two software supply chain attack techniques that need no exploit, no credential theft, and no code injection into any trusted package. Dependency confusion exploits a build tool's resolution order, letting a public package with a higher version number silently replace an organisation's privately named internal package. Typosquatting relies instead on a name that is deliberately close to a popular legitimate package, trusting a developer's or an automated script's typing mistake. The course covers the exact configuration mistakes that create exposure to each, the defensive controls that close them, including namespace reservation, scoped packages, and explicit private registry configuration that never silently falls back to a public source, the detection signals worth watching both externally on public registries and inside a build pipeline, and the incident response shape appropriate to a package that is malicious by design rather than merely flawed. Every scenario in this course is explicitly hypothetical.
Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.
None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.
You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.
The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.
