supply-chain
Safeguard articles tagged "supply-chain" — guides, analysis, and best practices for software supply chain and application security.
850 articles
Browser Extension Permission Models and Supply Chain Risk
Browser extensions operate with broad permissions and auto-update silently. Here is how the extension permission model creates supply chain risks and what organizations can do about it.
Browser Extension Attacks and the Supply Chain
Browser extensions run with elevated privileges and update automatically. When attackers compromise or acquire popular extensions, they gain access to millions of users instantly.
Makefile Injection Attacks: When Build Automation Becomes a Weapon
Makefiles execute shell commands by design. When those commands incorporate untrusted input, the results are predictably dangerous.
Real Estate and PropTech Security Considerations
PropTech platforms handle wire transfers, personal data, and property records. Software supply chain security is essential as real estate goes digital.
Build Reproducibility: A Verification Guide
If you cannot reproduce a build bit-for-bit, you cannot verify it was not tampered with. This guide covers deterministic builds, reproducibility verification, and why it matters for supply chain trust.
Tekton Pipeline Security Guide
Securing Tekton CI/CD pipelines on Kubernetes with task isolation, supply chain verification, and least-privilege service accounts.
Package Lock Files and Their Security Implications
Lock files are your first line of defense against dependency drift. This guide explains how package-lock.json, yarn.lock, and similar files protect your builds from supply chain manipulation.
VS Code Extension Marketplace Security: The IDE Supply Chain
VS Code extensions run with the same privileges as your editor — which means full access to your source code, terminal, and credentials. The marketplace security model does not prevent malicious extensions.
GDPR and Software Supply Chain Obligations You Can't Ignore
GDPR's security requirements extend deep into software supply chains. Here's where data protection law meets dependency management.
Telecommunications Supply Chain Security: Protecting Critical Infrastructure
Telecom networks are critical infrastructure that depend on complex software supply chains. Here's how carriers and equipment providers should approach security.
Database Extensions as Supply Chain Risk: The Overlooked Attack Surface
PostgreSQL extensions, MySQL plugins, and database add-ons run with database-level privileges. A compromised extension has direct access to your data. Most organizations never audit them.
Compression Library Vulnerabilities: From zlib to the xz Backdoor
Compression libraries are everywhere and trusted implicitly. The xz backdoor proved that trust can be weaponized. Here is the full picture.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.