Software Supply Chain
In-depth guides and analysis on software supply chain from the Safeguard engineering team.
100 articles
What is platform as a service (PaaS) and who secures what?
PaaS lets you deploy your own apps on a provider's platform without managing servers. Learn the NIST definition and the security duties that stay with you.
What is Sigstore Fulcio and how does it issue signing certificates?
Fulcio is Sigstore's code signing certificate authority. It swaps an OIDC identity token for a certificate valid 10 minutes, so no long lived keys.
What is an SBOM hub and how do you share SBOMs with customers?
An SBOM hub is where authors publish SBOMs and consumers fetch them. CISA names three roles. How to pick a sharing method and control access.
What is a Trojan horse and how is it different from a virus?
A Trojan horse looks useful but hides malicious code and relies on you running it. See how it differs from viruses and worms and how to defend against it.
What does autonomous, continuous supply chain security mean?
Continuous means checking on every change, not once a quarter. Autonomous means software takes the routine actions. Here is where to draw the line.
What does a certificate authority do, and why do browsers trust it?
A certificate authority signs certificates that tie a public key to a domain. Learn how trust chains, ACME, revocation and transparency logs work.
What are the benefits of SD-WAN, and what does it not fix?
SD-WAN gives you central policy, path choice across several links and faster branch rollout. It does not secure traffic by itself. Here is how to judge it.
How do you vet a Ruby gem before you install it?
Fetch and unpack the gem, read the gemspec and any extension script, check owners and release history, then install with a lockfile and cooldown.
How do you vet a Maven Central package before you add it?
Maven Central checks metadata and signatures at publish time, not trust. Here is a short routine to vet a new dependency before it lands in your pom.xml.
What is OWASP CICD-SEC-8, ungoverned third-party services in CI/CD?
CICD-SEC-8 warns that plugins, apps and tokens added to pipelines get broad access with little review. Approve, scope, watch and remove each integration.
How can an npm package write outside node_modules?
Old npm CLI versions let a package bin field create symlinks outside node_modules, even with ignore-scripts on. Update npm and treat installs as code.
How do you build a CI/CD pipeline you can trust?
A trusted pipeline controls who can change it, what it can reach and what it ships. Use OWASP's CI/CD risks and SLSA levels to harden each of the three.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.