sbom
Safeguard articles tagged "sbom" — guides, analysis, and best practices for software supply chain and application security.
100 articles
LLM Supply Chain Vulnerabilities
Malicious model files, poisoned datasets, and compromised ML packages are the new software supply chain frontier. Here is how these LLM attacks actually work.
NuGet dependency confusion risk report
NuGet's default feed-resolution behavior keeps dependency confusion risk elevated across .NET orgs. Here's what the incident history shows, and how to close the gap.
Best open source license compliance tools
A practical comparison of open source license compliance tools—FOSSA, Mend, Black Duck, Snyk, and more—covering detection accuracy, policy engines, and SBOM support.
Composer package vulnerability trends report
Composer package vulnerabilities rose 34% YoY, with 60%+ arriving via transitive dependencies. Safeguard breaks down the trends and what security teams should do.
Docker Security Scanning: How to Find Vulnerabilities in Your Images
Docker security scanning inspects your container images for known-vulnerable OS and application packages before they reach production. Here is how it works and how to wire it into your pipeline.
Best software supply chain security platforms
A practical buyer's guide comparing top software supply chain security platforms—SBOM, dependency scanning, and CI/CD attestation—so you can pick the right fit.
Best software provenance verification tools
A practical, no-fluff comparison of software provenance verification tools — Sigstore, in-toto, GitHub Attestations, JFrog, Chainguard, and Kosli — plus what to evaluate before you buy.
SCA and Application Security: How Software Composition Analysis Fits In
SCA application security is about finding and fixing risk in the open-source code you depend on. Here is where it fits alongside SAST and DAST.
Most vulnerable PHP frameworks report
A data-driven look at CVEs across Laravel, Symfony, CodeIgniter, Yii2 & ThinkPHP reveals which PHP frameworks carry the most real-world exploitation risk.
Drupal module vulnerability trends
Contributed modules drive most Drupal risk today. Here's what the advisory trends show — and how reachability analysis changes triage.
Best VEX (Vulnerability Exploitability eXchange) tools
A practical buyer's guide to VEX tools: what to evaluate, and an honest look at Dependency-Track, GUAC, OpenVEX, Grype, Trivy, and Interlynk.
Do Not Pass GO: Malicious Golang Package Alert
A typosquat of boltdb/bolt stayed cached on Go's module proxy for roughly three years after its source repo was cleaned up — proxy caching beats takedowns.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.