Supply Chain
How do you answer questions about build pipeline security?
Cover pipeline access, isolation, secrets, signing and provenance. Use SLSA levels as shared vocabulary and claim only what you actually run.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you answer 'are we affected?' after a supply chain incident
When a package or vendor is reported compromised, you need a fast, evidence-backed yes or no. Steps, sources of truth and what to record in your answer.
Oct 18, 20263 min read
Supply Chain
How does an SPDX SBOM say which component depends on which?
SPDX records dependencies as relationship lines such as DEPENDS_ON and CONTAINS. How to read them, the main types, and the mistakes that break the graph.
Oct 18, 20263 min read
Supply Chain
How SBOMs travel up an automotive supplier chain, tier by tier
CISA's worked example follows an SBOM from a tier 3 open source library to the carmaker. Who authors, who distributes and where vehicle chains get stuck.
Oct 18, 20264 min read
Supply Chain
How recent should a dependency's last release be?
OpenSSF guidance suggests activity and a release within 12 months, and Scorecard looks at 90 days. How to apply both without mislabeling stable code.
Oct 18, 20264 min read
Supply Chain
How does pip hash checking mode work and when should you use it?
Hash checking mode makes pip verify every download against sha256 hashes in requirements.txt. What it requires, how to generate hashes, and its limits.
Oct 18, 20263 min read
Supply Chain
How often should you refresh an open source inventory?
Refresh the inventory on every release and on a schedule between releases, since new advisories and dependencies change the picture after a deal closes.
Oct 18, 20263 min read
Supply Chain
How often should you refresh the SBOM you give customers?
Issue a new SBOM with every release, and update it when new component facts emerge. Date it, so customers can tell how current it is. Here is the rule.
Oct 18, 20263 min read
Supply Chain
How often are advisories withdrawn? OSV data across seven ecosystems
3.4% of 44,476 OSV advisory records are withdrawn, from 1.6% in Maven to 5.9% in RubyGems. Why withdrawals happen and how scanners should treat them.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.