Software Supply Chain
In-depth guides and analysis on software supply chain from the Safeguard engineering team.
100 articles
How do you point Maven at a private mirror of Maven Central?
Configure a mirror in settings.xml with mirrorOf central, run a repository manager as the cache, and add checks so the mirror does not become a blind spot.
How do you run a private mirror for Docker Hub images?
A pull-through cache registry stores Docker Hub images locally for all your daemons. Learn how to set it up, its limits, and how to keep it trustworthy.
How do you run a private Composer repository in front of Packagist?
Composer checks repositories top to bottom, so you can host your own, switch off packagist.org and control exactly which PHP packages reach your builds.
How do you stop gem typosquats and dependency confusion in Bundler?
Pin each internal gem to its own source, add lockfile checksums, and set a Bundler cooldown so brand new releases are not installed before they are vetted.
How do you run a private mirror or proxy for RubyGems?
A private RubyGems proxy gives builds one controlled source, cached copies and an audit trail. Set it up with scoped sources, no direct egress and review.
What does a malicious RubyGems package look like and how do you respond?
Check new gems for install-time code, odd owners and fresh releases. If one landed, rotate secrets first, then remove it, report it and rebuild from a clean lockfile.
How do you generate an SBOM for a Ruby project?
Generate a CycloneDX SBOM for a Ruby app from Gemfile.lock with the cyclonedx-ruby gem, then check completeness, store it per build and scan it.
How should you manage Ruby gem dependencies safely?
Manage Ruby gems with a committed Gemfile.lock, pessimistic version ranges, checksums, a release cooldown, scoped sources and an advisory audit in CI.
How does a retail bank start a software supply chain security program?
Start from the third-party risk life cycle regulators already expect, add SBOMs and build controls for software you ship, and tier vendors by criticality.
How does Python package typosquatting work and how do you avoid it?
Typosquatting and dependency confusion trick pip into installing the wrong package. See how Python names normalize and how to install safely.
How do you defend a Python project from PyPI typosquats and dependency confusion?
Use one trusted index, pin hashes, block source builds where you can, and review every new package name before it enters a requirements file.
How do you run a private PyPI mirror or proxy safely?
A private PyPI mirror gives you one controlled index. Learn the index settings, why extra indexes are risky, and how hash checking stops swapped files.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.