Supply Chain
How do you make Amazon ECR image tags immutable?
Turn on tag immutability per ECR repository so a pushed tag cannot be overwritten. Console and CLI steps, the exclusion option, and one catch with caches.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you list the licenses of everything inside a container image?
Generate an SBOM for the image, including base image packages, and read the license field. With Docker buildx, add the sbom attestation flag.
Oct 18, 20264 min read
Supply Chain
How do you inventory every dependency in a data platform?
A practical checklist to inventory a data stack: dbt packages, Airflow providers, notebook environments, cluster libraries and warehouse connectors.
Oct 18, 20263 min read
Supply Chain
How do you hash a sharded model for an AI bill of materials?
Large models ship as many shards plus an index file. Hash every file, record the index, and pin the revision so your AI BOM can prove what you ran.
Oct 18, 20264 min read
Supply Chain
How do you get an SBOM from a compiled Go or Rust binary?
Go binaries carry build information and Rust binaries can carry audit data. How to read them into a rudimentary SBOM, and why the result needs caution.
Oct 18, 20263 min read
Supply Chain
How do I generate an SBOM for npm, Python and Maven projects?
Generate an SBOM from your lockfile or build, not from memory. Here are the commands for npm, Python and Maven projects, and what to check in the output.
Oct 18, 20263 min read
Supply Chain
How do you get an SBOM from a vcpkg project?
vcpkg writes an SPDX file per installed package. Where to find them, what they record, how to convert to CycloneDX and what to check before sharing.
Oct 18, 20263 min read
Supply Chain
How do you generate an SBOM for a container image?
Use BuildKit to attach an SPDX SBOM when you build, check which stages it covers, and combine OS packages with language dependencies for a full inventory.
Oct 18, 20264 min read
Supply Chain
How do I find out when a library in my AI stack has a new advisory?
Set up advisory intake for your AI stack: an SBOM as the source of truth, feeds from public databases, a KEV check, and an owner who gets the alert.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.