Supply Chain
Is it safe to pull Android and JVM dependencies from JitPack?
JitPack builds Git projects on demand. Risk depends on what you pin: use release tags or commits, filter the repository, and avoid branch snapshots.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Is it safe to mix conda channels in an ML environment?
Conda docs advise against mixing channels in one environment. What channel priority does, what strict mode changes, and how to keep ML builds predictable.
Oct 18, 20264 min read
Supply Chain
Is go.sum a lockfile? What it records and what it does not
No. go.sum holds hashes that verify downloads, while go.mod picks versions. Here is what each file does and what a scanner should read from a Go project.
Oct 18, 20264 min read
Supply Chain
Is an SBOM the same as a lockfile?
No. A lockfile pins versions so installs repeat. An SBOM is a standard, shareable inventory of components. Here is how the two differ and work together.
Oct 18, 20263 min read
Supply Chain
Is a supply chain incident over once the registry removes the package?
No. Registry removal stops new downloads only. Installed copies, caches, builds and stolen secrets remain. Myth versus fact, with what to do next.
Oct 18, 20263 min read
Supply Chain
Is a package with one maintainer too risky to depend on?
One maintainer is common and not disqualifying. What matters is what happens if they leave or are compromised. Here is how to judge and reduce the risk.
Oct 18, 20262 min read
Supply Chain
Is a git URL dependency safe to approve in a pull request?
A git or tarball URL dependency skips the registry and can move. Check that it is pinned to a commit, who owns it, and why a release will not do.
Oct 18, 20264 min read
Supply Chain
Is a floating version in a CDN script URL safe to use?
Version ranges and latest in a CDN URL let content change without your deploy. Pin an exact version and add an integrity hash for production pages.
Oct 18, 20263 min read
Supply Chain
Is a Cloudflare Workers compatibility date a security update?
No. The compatibility date gates behavior changes in the Workers runtime. It does not update your npm dependencies. What it does, and what you still own.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.