Software Supply Chain
How do you generate an SBOM for a Ruby project?
Generate a CycloneDX SBOM for a Ruby app from Gemfile.lock with the cyclonedx-ruby gem, then check completeness, store it per build and scan it.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSoftware Supply Chain
How should you manage Ruby gem dependencies safely?
Manage Ruby gems with a committed Gemfile.lock, pessimistic version ranges, checksums, a release cooldown, scoped sources and an advisory audit in CI.
Oct 18, 20264 min read
Software Supply Chain
How does a retail bank start a software supply chain security program?
Start from the third-party risk life cycle regulators already expect, add SBOMs and build controls for software you ship, and tier vendors by criticality.
Oct 18, 20264 min read
Software Supply Chain
How does Python package typosquatting work and how do you avoid it?
Typosquatting and dependency confusion trick pip into installing the wrong package. See how Python names normalize and how to install safely.
Oct 18, 20265 min read
Software Supply Chain
How do you defend a Python project from PyPI typosquats and dependency confusion?
Use one trusted index, pin hashes, block source builds where you can, and review every new package name before it enters a requirements file.
Oct 18, 20264 min read
Software Supply Chain
How do you run a private PyPI mirror or proxy safely?
A private PyPI mirror gives you one controlled index. Learn the index settings, why extra indexes are risky, and how hash checking stops swapped files.
Oct 18, 20264 min read
Software Supply Chain
How do lockfiles and pinning work for PyPI packages?
Pinning fixes versions, hashes fix the exact files, and lock formats like uv.lock and pylock.toml record both. Learn how to install from PyPI reproducibly.
Oct 18, 20265 min read
Software Supply Chain
How do you publish to PyPI with provenance (trusted publishing and attestations)?
Use PyPI trusted publishing so CI mints a 15 minute token by OIDC, then attach PEP 740 attestations so users can check which workflow built each file.
Oct 18, 20264 min read
Software Supply Chain
How do you publish an npm package with provenance?
Publish from GitHub Actions or GitLab CI on a cloud runner with npm 9.5 or later, grant id-token write, and verify with npm audit signatures.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.