Software Supply Chain
In-depth guides and analysis on software supply chain from the Safeguard engineering team.
100 articles
SLSA vs SSDF: how the two supply chain frameworks differ
SLSA hardens how software is built and proves it with provenance. NIST SSDF covers the whole secure development practice. See the overlap and which to use.
How do you mitigate slopsquatting across a development team?
Slopsquatting is registering package names that AI tools invent. Mitigate with a registry proxy, package review, agent install limits and reserved names.
What Is Sigstore Rekor and How Do You Verify an Entry?
Rekor is Sigstore's append-only transparency log for signing records. Learn what it stores, what it proves, and how to check that an artifact was logged.
How do you secure a software supply chain that includes AI?
AI adds models, datasets and tools to your supply chain. Extend SSDF practices to them: inventory, provenance, pinning, review and a clear owner for each.
What are the best practices for building Java containers with Docker?
Build Java images with multi-stage builds, a slim pinned base, a non-root user and a dropped-privileges runtime. Then scan the dependencies inside the jar.
How do you manage PHP dependencies securely with Composer?
Commit composer.lock, deploy with install not update, run composer audit in CI, and skip dev packages in production. A short checklist for PHP teams.
How do you manage Scala dependencies securely with sbt?
Pin exact versions in sbt, control resolvers, watch cross-built artifact names, review evictions and scan the resolved tree, not just build.sbt.
SBOMs vs attestations: what does each one prove?
An SBOM lists what is inside software. An attestation is a signed claim about how it was built or checked. See what each proves and how to use both.
Why does an SBOM matter when something breaks? A constructed case
A constructed case of an old fielded system and a new library flaw shows what an SBOM answers in the first hour and what it leaves open. Test yours.
How should you share an SBOM? Formats, delivery, customer questions
Share SBOMs in SPDX or CycloneDX, signed, through a channel customers can automate. Here is how delivery works and which customer questions to prepare for.
How does a SaaS startup build a supply chain security program from zero?
Start with an inventory, lockfiles and a CI gate, then add provenance and a vendor list. A staged plan for a small SaaS team, using NIST SSDF and SLSA.
Should you run a private npm mirror or proxy, and what does it fix?
A private npm proxy caches packages, gives one control point and binds scopes to internal sources. It does not vet packages for you. Setup notes.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.