Supply Chain
Should a PyPI API token be account-wide or project scoped?
Limit every PyPI upload token to a single project. See why account-wide tokens are risky in CI, and how this compares with trusted publishing.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Does the scanner cover your stack? An ecosystem checklist
A checklist for confirming a dependency scanner reads every language, package manager, build file and image type you use, before you sign anything.
Oct 18, 20263 min read
Supply Chain
SCA vs SBOM: what is the difference?
SCA is an activity that finds known vulnerabilities in components. An SBOM is an inventory document of those components. Here is how they fit together.
Oct 18, 20263 min read
Supply Chain
Does your SCA tool catch malicious packages, or only known CVEs?
Known-vulnerability scanning and malicious package detection are different jobs. What to ask an SCA vendor about malware, typosquats and timing.
Oct 18, 20263 min read
Supply Chain
How do you tie an SBOM to the exact release a customer runs?
Map every SBOM to one release using version-specific URLs, files shipped with the software, or pointers, as the NTIA guidance on delivery describes.
Oct 18, 20263 min read
Supply Chain
SBOM tool evaluation checklist: ten tests to run on your own repo
A buyer's checklist for SBOM tools: ten concrete tests to run on your own repositories, from transitive depth to format validity, before you sign anything.
Oct 18, 20264 min read
Supply Chain
SBOM sharing by email, portal or registry: six patterns compared
Six real ways to share SBOMs, from email with an NDA to federated attestation registries, with the benefits, cautions and ratings CISA gives each.
Oct 18, 20264 min read
Supply Chain
How SBOM sharing works: discovery, access and transport
Creating an SBOM is half the job. CISA splits sharing into three phases, discovery, access and transport, each with low, medium and high sophistication.
Oct 18, 20263 min read
Supply Chain
How should a software vendor handle a customer SBOM request?
A five-step intake workflow for customer SBOM requests: confirm the ask, pick the SBOM type, check it, deliver it with terms, and log what you sent.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.