Software Supply Chain
In-depth guides and analysis on software supply chain from the Safeguard engineering team.
100 articles
How do lockfiles and pinning work for PyPI packages?
Pinning fixes versions, hashes fix the exact files, and lock formats like uv.lock and pylock.toml record both. Learn how to install from PyPI reproducibly.
How do you publish to PyPI with provenance (trusted publishing and attestations)?
Use PyPI trusted publishing so CI mints a 15 minute token by OIDC, then attach PEP 740 attestations so users can check which workflow built each file.
How do you publish an npm package with provenance?
Publish from GitHub Actions or GitLab CI on a cloud runner with npm 9.5 or later, grant id-token write, and verify with npm audit signatures.
How do you publish a Node.js Docker image to Docker Hub with Actions?
A GitHub Actions workflow that builds a Node.js image and pushes it to Docker Hub with an access token, least-privilege permissions and pinned actions.
How do you publish to crates.io without a long-lived token?
Use short-lived OIDC credentials from CI instead of stored crates.io tokens, and scope and expire any token you keep. Here is the model and the checks.
What is poisoned pipeline execution (CICD-SEC-4) and how do you stop it?
Poisoned pipeline execution lets someone with repo access run commands in your CI by editing pipeline config or files it uses. See the types and fixes.
Can you publish to Packagist with provenance?
Packagist builds versions from your repository tags, so provenance starts at your repo. Learn what that means, the hook token risk and what to check.
What does package-lock.json do and should you commit it?
package-lock.json pins the exact dependency tree npm installed. Commit it for apps, install with npm ci in CI, and review its diffs like code. Here is why.
OSV vs NVD: which vulnerability database should you use?
NVD enriches CVE records with scores and product data; OSV maps advisories to exact package versions. See how they differ and why many scanners use both.
How do open source vulnerability scanners work and how do you pick one?
Open source scanners match your dependencies to public vulnerability data. Compare data sources, ecosystem coverage and false positives on your own repos.
Open source risk management for CISOs: what to measure
Finding counts mislead. CISOs get a truer view from coverage, known exploited exposure, reachable flaws, time to fix and unknowns. Track these.
How should an open source maintainer answer a vendor security questionnaire?
Maintainers owe no one a questionnaire. Publish a security policy, point to public evidence, keep one answers file, and ask the company to fund the extra work.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.