Supply Chain
How do customers find your CSAF advisories automatically?
How CSAF discovery works: the provider metadata file, the security.txt CSAF field, the well-known URL and the DNS path, with the exact requirements.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How many indirect dependencies is too many for one package?
There is no magic number, but the size of a package's dependency tree is a real security cost. How to measure it and how to set a limit for your team.
Oct 18, 20264 min read
Supply Chain
How a scanner compromise reached an LLM gateway library
The Trivy compromise and the LiteLLM releases that followed show how one stolen token can cascade. What sources state, what they do not, and the lessons.
Oct 18, 20263 min read
Supply Chain
What does a Go retract directive do, and is it a security fix?
A retract directive warns users away from a Go module version and hides it from latest queries. It does not remove the version or break existing builds.
Oct 18, 20263 min read
Supply Chain
Is the Go replace directive safe to use and commit?
A replace directive swaps a Go dependency for a fork or local path and skips authentication of that module. Learn when it is safe and how to review it.
Oct 18, 20263 min read
Supply Chain
What is a Go pseudo-version and is it safe to depend on?
A Go pseudo-version names an exact commit when no release tag exists. Learn how to read one, why it is reproducible, and when to replace it with a tag.
Oct 18, 20263 min read
Supply Chain
Why does my Go project have two versions of one module (v2 suffix)?
Go treats module/v2 as a separate module from module, so both can sit in one build. Why that happens and how to make sure each copy gets patched.
Oct 18, 20263 min read
Supply Chain
GitHub immutable releases: what gets locked and what does not
Immutable releases lock a release's tag and assets and create a verifiable attestation. What stays editable, and the workflow GitHub recommends.
Oct 18, 20263 min read
Supply Chain
Are git and tarball URL dependencies in package.json safe?
npm can install from git URLs, GitHub shorthand and tarball links, which skip registry controls. Learn the risks, what runs at install, and how to pin.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.