Supply Chain
Internal registry, mirror or proxy: what is the difference?
An internal registry hosts your own packages, a mirror copies a public one, and a proxy fetches on demand. Learn which does what and which you need.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you install a Helm chart by digest from an OCI registry?
Add the sha256 digest after an at sign in the oci reference. Helm docs say digests are immutable, so you run exactly the chart you reviewed. Steps inside.
Oct 18, 20263 min read
Supply Chain
Immutable releases on GitHub: what they lock and what they do not
Immutable releases lock a release's tag and assets after publishing and add an attestation. What that stops, what stays editable, and how to use it.
Oct 18, 20263 min read
Supply Chain
If your update server is hacked, what stops a malicious update?
A hacked update server should not push code to every install. Client signature checks, keys kept off the server and signed metadata decide that.
Oct 18, 20263 min read
Supply Chain
How do you ask a supplier for an SBOM and get a usable one?
A vague SBOM request gets a vague file. Name the product, version, format, depth and refresh rate, then check what arrives before you accept it.
Oct 18, 20263 min read
Supply Chain
How do you vet a new Go dependency before running go get?
A checklist for judging a Go module before you add it: deprecation, retractions, advisories, init side effects, transitive weight, and maintainer signals.
Oct 18, 20263 min read
Supply Chain
How do I vet a new AI library before adding it to my stack?
A 15 minute vetting checklist for new AI and agent libraries: maintainers, release habits, advisories, install behavior, license, and how deep it reaches.
Oct 18, 20263 min read
Supply Chain
How do you vet a mobile SDK before adding it to your app?
A checklist for judging a mobile SDK before you ship it: permissions, data collection, maintenance, transitive code and store policy. Steps.
Oct 18, 20263 min read
Supply Chain
How to version and timestamp an SBOM document under the 2026 elements
CISA's 2026 elements add an SBOM Version and tighten the timestamp. What to put in each, when to bump the version and which standards the text points to.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.