SLSA, pronounced "salsa," is a set of incrementally adoptable guidelines for supply chain security, established by industry consensus. Producers use it to harden how software is built, and consumers use it to decide whether to trust a package. Higher levels mean stronger protection and more effort.
Tracks and levels
SLSA organizes guidance into tracks, each focused on one part of the supply chain. The v1.0 specification has a single track, the Build track, and says future versions may add tracks for areas such as source code management. Note that the v1.0 page now shows as retired, with version 1.2 listed as the current one, so check the current spec before citing details.
Within the Build track, levels run from 1 to 3. Software that meets none is described as SLSA 0. Each step adds protection against supply chain threats and costs more to put in place.
What the build track is getting at
The Build track cares about how an artifact was produced. The questions are simple to state:
- Was it built by a defined, repeatable process?
- Can a consumer see how it was built?
- Can the build output be trusted not to have been altered along the way?
The answers become evidence, usually a signed statement of how the artifact was made, called provenance. A consumer can check that evidence before installing.
Why incremental matters
Most teams cannot jump to the top level in one quarter. The levels give a path: start by producing provenance at all, then harden the build platform and make the evidence harder to forge. Each level is a stopping point you can explain to a buyer.
What SLSA does not cover
SLSA says nothing about whether the code you wrote is free of bugs, and it does not check your dependencies for vulnerabilities. It speaks to build integrity. Pair it with dependency scanning and the secure development practices in NIST's SSDF.
Safeguard focuses on dependency scanning, policies and gates, and evidence automation. A free scan is at gold.safeguard.sh/scan.
Quick check
Is SLSA a certification?
No. The source describes it as guidelines. You can assess yourself against the levels, but the guidelines themselves are not a certificate.
How many Build track levels are there in v1.0?
Three, Levels 1 through 3, plus SLSA 0 for software that meets none.
Sources
Last reviewed: 19 October 2026.
