Software Supply Chain
In-depth guides and analysis on software supply chain from the Safeguard engineering team.
100 articles
What is the future of software supply chain security?
Five shifts already visible in 2026: machine-readable inventories, provenance, risk-based buying, AI components and agents as identities. What to prepare.
How do you start a software supply chain security program at a telecom?
Start with an inventory of vendor images and software, verify what you install, patch on a defined path, then segment, log and set supplier expectations in contracts.
How should Tekton pipelines handle secrets and credentials?
Keep Tekton credentials in Kubernetes Secrets, bind them to narrow ServiceAccounts, mount them only in the Steps that need them, and keep them out of logs.
How do you pin third-party tasks and pipelines in Tekton?
Reference remote Tekton tasks by commit SHA or bundle digest through resolvers, switch off resolvers you do not use, and verify signatures with trusted resources.
How do you sign and prove provenance for TeamCity artifacts?
Sign TeamCity build artifacts with a key the build steps cannot read, ship a provenance record, and verify both before deploy. Here is what SLSA expects.
How do you pin and vet third party plugins in TeamCity?
TeamCity plugins can reach everything on the server. Learn how JetBrains says to install them, how to hold a version and how to review plugin changes.
What are the main software supply chain threat vectors and defenses?
Supply chain attacks hit source, build, dependencies and registries. The SLSA threat model lists eight integrity threats, each with a matching control.
What is changing in software supply chain security in 2026?
US federal rules loosened, SBOM guidance tightened, EU dates arrived and two package hijacks hit in March. Here is what changed and what to do next.
How do you manage risk in the software supply chain?
Manage software supply chain risk by tiering suppliers, keeping an inventory, controlling what enters builds, asking for evidence and planning for failure.
Supply chain security: how big is your confidence vs readiness gap?
Teams often feel ready for supply chain attacks without testing it. Use six evidence-based questions to turn a feeling into a measured readiness score.
How do you trace the provenance of every software component?
Provenance records who built an artifact, how and from what inputs. How SBOMs, SLSA provenance and in-toto fit together, and a practical way to start.
What is the software distribution chain problem?
Attackers now target how software is delivered, not written. See how xz and KICS show the gap between reviewed source and installed code, and close it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.