Software Supply Chain Security
How to enable Dependabot version updates
A step-by-step guide to enabling Dependabot version updates on GitHub, including dependabot.yml configuration, scheduling, and verification checks.
Feb 21, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSoftware Supply Chain Security
SCA with Reachability: A Buyer Guide for 2026
How to evaluate software composition analysis tools that claim reachability analysis, including the technical questions that separate real implementations from marketing.
Feb 20, 20265 min read
Software Supply Chain Security
Dependency Firewalls: Concept, Architecture, and Implementation
A dependency firewall sits between your build system and public registries, filtering packages based on security policies. Here is how to design and implement one.
Feb 19, 20267 min read
Software Supply Chain Security
How to configure GitHub branch protection rules
A practical guide to configuring GitHub branch protection rules — required reviews, status checks, and security settings that keep your main branch safe.
Feb 18, 20268 min read
Software Supply Chain Security
How to set up signed commits with GPG
A step-by-step guide to set up GPG signed commits in Git: generate a key, configure Git, publish it to GitHub, verify signatures, and fix common errors.
Feb 17, 20267 min read
Software Supply Chain Security
How to implement software supply chain security with SLSA
A step-by-step guide to implement SLSA supply chain security: map risk, generate signed provenance, and enforce verification before deploy.
Feb 17, 20268 min read
Software Supply Chain Security
Crates.io Security Audit Results: The State of Rust Package Security
Security audits of the Rust crate ecosystem reveal patterns of unsafe code, build script risks, and supply chain vulnerabilities. Here is what the data shows.
Feb 16, 20266 min read
Software Supply Chain Security
Abandoned Package Takeover: When Maintainers Walk Away
Abandoned packages are ticking time bombs in the supply chain. When maintainers disappear, attackers can take over package names and push malicious updates to millions of downstream projects.
Feb 16, 20265 min read
Software Supply Chain Security
SLSA Level 3 Implementation Blueprint 2026
A practical blueprint for reaching SLSA Level 3 in 2026: hosted builders, provenance generation, verification gates, and the operational habits that hold the line.
Feb 15, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.