Supply Chain
How many OSV advisories list a fixed version? Share by ecosystem
74% to 95% of OSV advisory records name a fixed version, by ecosystem: NuGet highest, crates.io lowest. What the gap means for upgrade planning.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How many KEV entries are open source packages? 133 of 1,748
133 of 1,748 KEV CVE IDs (7.6 percent) appear in advisories for eight package ecosystems. Most of KEV lives outside your lockfile, but those 133 matter.
Oct 18, 20263 min read
Supply Chain
How many dependency ecosystems does a cross-platform app have?
A React Native or Flutter app often has three or more dependency ecosystems. Where each lockfile lives and why one scan of one file misses most of the app.
Oct 18, 20263 min read
Supply Chain
How many advisories say a package was vulnerable from version zero?
In OSV, 67 to 83 percent of advisories start the affected range at the first release. Why 'downgrade' rarely fixes anything, and a crates.io counting trap.
Oct 18, 20263 min read
Supply Chain
How many advisories list a fixed version? Eight ecosystems compared
Between 4.6 percent (NuGet) and 25.0 percent (crates.io) of OSV advisories have no fixed version recorded. What a missing fix means and how to respond.
Oct 18, 20264 min read
Supply Chain
How fast should an open source maintainer fix a vulnerability?
The OpenSSF passing badge asks for a first response within 14 days and no medium or higher flaw publicly known for over 60 days. Use them as yardsticks.
Oct 18, 20264 min read
Supply Chain
How does Terraform verify a provider it downloads?
Terraform checks provider packages against lock file checksums, a trust on first use model. What it protects, what it leaves to you, and a review routine.
Oct 18, 20263 min read
Supply Chain
How does Swift Package Manager handle a binary SDK and its checksum?
A Swift binary target points to a zip archive with a checksum of that archive. What it tells you, what it does not, and what to ask the SDK vendor.
Oct 18, 20263 min read
Supply Chain
How does GitLab dependency scanning work with SBOMs?
GitLab dependency scanning builds a CycloneDX SBOM in CI and matches it to advisories, then rescans when new advisories land. Here is how it works.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.