Supply Chain
How do you promote releases through a quarantine repository?
A quarantine repository holds new artifacts until checks pass, then promotion copies the same digest forward. Layout, gates, permissions and evidence.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you prioritize findings from a supplier SBOM you cannot inspect?
Rank supplier SBOM findings without source code using exploitation evidence, supplier VEX, exposure and fix availability. A four step method.
Oct 18, 20263 min read
Supply Chain
Pin Python dependencies in data projects: notebooks, jobs and images
Data projects often run unpinned installs in notebooks and jobs. How to pin, lock and scan Python dependencies so analysis and pipelines are repeatable.
Oct 18, 20263 min read
Supply Chain
Pin CUDA and ML base images by digest without losing patches
Pinning a base image by digest keeps training builds repeatable and blocks silent tag swaps. How to pin and still get security fixes through pull requests.
Oct 18, 20264 min read
Supply Chain
Should you pin container base images by digest?
A tag can point to different content tomorrow; a digest cannot. When pinning by digest helps rebuilds and recovery, and the update habit you need with it.
Oct 18, 20263 min read
Supply Chain
How do you choose a safe version after a package compromise?
Pick the last version released before the incident, confirm it against the maintainer notice, and check its files. A quick decision guide for pinning.
Oct 18, 20263 min read
Supply Chain
How do you replace a compromised CI action across every repo in a day?
A runbook for when a third party CI action is compromised: find usage, cut exposure, rotate secrets and ship the fix by pull request.
Oct 18, 20263 min read
Supply Chain
What is OWASP A03 Supply Chain Failures, and how do you test for it?
OWASP A03:2025 widens vulnerable components to the whole software ecosystem. What it covers, why it needs inventory, and how to check a tool's claims.
Oct 18, 20263 min read
Supply Chain
Which OSV advisories carry a severity? Counts across seven ecosystems
In OSV, 31% of 44,476 advisory records have no GHSA severity label, up to 55% for PyPI. Where severity is missing and how to triage without it.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.