Supply Chain
In-depth guides and analysis on supply chain from the Safeguard engineering team.
100 articles
What should you pin to make a data pipeline environment reproducible?
Pin the interpreter, every package with hashes, JVM coordinates, OS packages, the base image digest and tool versions. A table of layers and what drifts.
What should you do when your release signing key expires?
An expired key is a planned event, not an emergency. Extend or replace it, publish the new fingerprint in several places, and tell users before the date.
What if an acquisition target has no lockfiles in its repositories?
No lockfile means versions float at build time. Inventory the built artifact instead, record the gap, and plan to pin dependencies after close.
What should you do when a research tool's maintainer disappears?
A checklist for when an academic open source tool goes quiet: how to judge the risk, what signals to check, and when to fork, replace or isolate.
What should you do when a mobile SDK is abandoned or end of life?
When a mobile SDK stops getting updates, decide between replace, fork, freeze or remove. Signals to watch, a decision table and a timeline you can follow.
What should you check in SLSA provenance before you deploy?
Verifying provenance means more than a valid signature. The SLSA steps to follow and the fields to compare against expected values before deploying.
What should you check in a third-party Helm chart before installing it?
Before the first helm install of someone else's chart, render it and read the images, RBAC, webhooks, hooks and dependencies it brings.
What should you check in a self-hosted extension update setup?
A self-hosted Chrome extension depends on an update manifest URL and a signing key. Here is a short review checklist for transport, hosting and signatures.
What to check before adding a dependency to a payments service
Before a new library enters a payments service, check maintenance, release status, vulnerability handling, license fit and who will own updates.
What should you ask a customer before sending them your SBOM?
Five short questions about purpose, format, recipients, retention and reuse let you send the right SBOM, in the right form, to the right people.
What does the Verified account badge mean on Amazon ECR Public Gallery?
On the Amazon ECR Public Gallery, popular publishers can request a Verified account badge through support. Here is what that does and does not tell you.
What supply chain questions come first on a startup questionnaire?
The supply chain questions a first customer questionnaire usually asks, what each one is really testing, and how a small SaaS or ecommerce team can answer.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.