supply-chain
Safeguard articles tagged "supply-chain" — guides, analysis, and best practices for software supply chain and application security.
850 articles
GitHub Actions Security Best Practices in 2022
A practical guide to hardening your GitHub Actions workflows against supply chain attacks, secret leaks, and privilege escalation.
BlackCat/ALPHV Ransomware: Rust-Based Innovation and Supply Chain Exploitation
BlackCat (ALPHV) brought Rust programming, triple extortion, and supply chain targeting to the ransomware-as-a-service model, raising the bar for both attackers and defenders.
CDN Supply Chain Security Risks You Should Know
Content delivery networks serve billions of software assets daily. When a CDN is compromised, the blast radius is enormous. Here's what CDN supply chain risks look like and how to defend against them.
Dark Web Monitoring for Supply Chain Threats
Software supply chain credentials, stolen signing keys, and zero-day exploits for build tools are traded on dark web forums. Monitoring these channels provides early warning of supply chain attacks.
npm Lockfile Injection Attacks: How Tampered package-lock.json Files Compromise Builds
Lockfile injection is a subtle supply chain attack where malicious changes to package-lock.json redirect dependency resolution to attacker-controlled packages. Here is how it works and how to detect it.
WebAssembly Security: A Deep Dive into the Sandbox Model
WebAssembly promises near-native performance with a strong security sandbox. But the sandbox model has nuances that developers and security teams must understand to avoid dangerous assumptions.
Securing Terraform Infrastructure as Code: A Practitioner's Guide
Your Terraform code defines your production infrastructure. If an attacker compromises your HCL files, state files, or provider plugins, they do not just get access — they get the keys to rebuild your entire environment on their terms.
Building a Supply Chain Risk Appetite Framework
Every organization accepts some supply chain risk. The question is whether that acceptance is deliberate and documented or accidental and invisible.
Linux Distribution Package Signing: How It Actually Works
Package signing is the backbone of Linux software distribution security. Most teams trust it blindly without understanding the verification chain they depend on.
Mobile App Store Security Bypass: How Malicious Apps Evade Review
App store review processes catch most malware. But the bypass techniques that work reveal systematic gaps in mobile supply chain security.
Electron App Supply Chain Security: Desktop Apps Built on Web Dependencies
Electron apps ship a full Chromium browser and Node.js runtime to the desktop. That means every web supply chain risk becomes a desktop attack surface — with elevated privileges.
Kubernetes Supply Chain Policy Engines: Enforcing What Gets Deployed
Scanning for vulnerabilities means nothing if you cannot enforce the results. Supply chain policy engines in Kubernetes turn security findings into hard deployment gates.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.