Most supply chain security tools look at your source code or dependencies. Nobody looks at what actually ships. We kept finding things in dist/ that everything else missed, such as API keys baked into JS bundles, source maps accidentally shipped to prod, debug symbols inside release binaries, .env files that made it through the build. ReleaseGuard fixes that. Single binary. Point it at your dist folder:

releaseguard check ./dist # find the problems releaseguard fix ./dist # strip and harden releaseguard sign ./dist # sign + attest

SBOM generation, Sigstore keyless signing, SLSA provenance, OPA policy gates, and a GitHub Action all included. MIT licensed. https://github.com/Helixar-AI/ReleaseGuard