Supply Chain
In-depth guides and analysis on supply chain from the Safeguard engineering team.
100 articles
Which SBOM formats should a platform import? Test before you buy
What to check when a platform says it imports SBOMs: formats, spec versions, serializations, bad files and unknown fields, with a simple test set to build.
Which prototype dependencies should you replace before launch?
Replace prototype dependencies that are abandoned, redundant, unexplained or heavy on install scripts. A decision guide with a keep, swap or remove table.
Which of our products use this library? Answering it from SBOMs
To find which products use a library, search stored SBOMs by package URL and version range. Here is the method, the pitfalls and the follow up questions.
Which open source dependencies should your company fund?
Pick which dependencies to fund by criticality, maintainer capacity and replaceability. A three tier method that starts from your own inventory.
Which maintenance questions does the OpenSSF evaluation guide ask?
The OpenSSF guide for evaluating open source software asks five maintenance questions: activity, communication, maintainers, release recency, stability.
Which legacy libraries block a modernization project?
Find the libraries that block modernization by looking for unmaintained packages, pinned runtimes and tight framework coupling. A practical triage method.
Which Go versions still get security fixes? The two release rule
Go supports each major release until two newer ones exist, and fixes critical problems, including security ones, in minor revisions. How to apply it.
Which ecosystems does OSV cover, and what do the gaps mean?
OSV lists 29 ecosystems, from npm and PyPI to Linux distributions and GitHub Actions. Learn how to check your stack against the list and handle gaps.
Which ecosystems does GitHub review advisories for, and what about others?
GitHub reviews advisories for twelve named ecosystems. See the list, what unreviewed means for everything else, and how to cover the gaps in your stack.
Which document answers which buyer question: SBOM, VEX or a report?
A routing table for sales: when a buyer asks about components, vulnerabilities, controls or process, which document to send and which not to.
A new CVE landed: which devices in my fleet run the vulnerable component?
To find affected devices after a new CVE, match the component and version range against release SBOMs, then join to the device map. Steps and pitfalls.
Which dependency risk signals matter most for build tools?
Weigh dependency signals by what the package can touch. Build and CI tools run with your secrets, so they need stricter checks than a small runtime helper.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.