To prove whether a bad version reached production, trace one chain: the running workload, to its image digest, to the build that produced it, to the dependency list of that build. If every link is recorded, you can answer yes or no with evidence. If a link is missing, say so.
Declared, installed and running are different
A lockfile says what a project would install. An install log says what a build did install. A deployed image digest says what is running. A bad version can appear in one and not the others, so check all three.
The chain of evidence
- Running workload. Record the image digest for each service in each environment. Tags are not enough because a tag can be moved. The Docker CLI shows the manifest and digests for an image in a registry.
- Build record. Find the CI run that produced that digest, with start time, commit and logs.
- Dependency list. Use the SBOM stored at build time. If none exists, use the lockfile at that commit plus the install log.
- Window check. Compare the build time with the time the bad version was published and removed. A build outside the window could not have fetched it, unless a cache served it.
- Cache check. If a cache or mirror was in use, check whether it held the bad version during the window.
Outcomes and what to say
| Finding | Meaning | Action |
|---|---|---|
| Bad version in SBOM, image deployed | Reached production | Full response |
| Bad version in a build, never deployed | Reached CI only | Treat CI secrets as exposed |
| Not in any SBOM or log, chain complete | Not affected | Record the evidence |
| Chain broken, no SBOM or log | Unknown | Say unknown, rebuild clean |
Avoid saying not affected when the truth is we cannot tell. Customers and auditors accept a clear unknown with a plan far better than a claim you later retract. See how to answer when a customer asks if you were affected.
Make the next one easier
Store an SBOM with every release, keep image digests in deploy records, and keep build logs long enough to cover your slowest detection time. Promoting the same built artifact through environments, instead of rebuilding, also keeps the chain short. See build once, promote the same artifact.
Quick check
Is a tag good enough to identify what is deployed?
No. A tag can be re-pointed. Record the digest.
What if the bad version never ran in production but ran in CI?
Treat every secret that CI job could read as exposed and rotate them. Production code may be clean, but the build system saw the malware.
Safeguard stores SBOMs per scan and can run dependency scanning on container images, which helps keep this chain intact. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
