Supply Chain
Do generated API clients and server stubs add dependency risk?
Code generated from an OpenAPI file brings its own libraries and templates. How to inventory, scan and refresh generated clients and server stubs.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you generate a CycloneDX SBOM from a Conan project?
Conan 2 can build CycloneDX 1.4 and 1.6 SBOMs from the resolved graph through a hook. How it works, where files go and what its experimental status means.
Oct 18, 20263 min read
Supply Chain
How do you stop dependency confusion in a Gemfile with two sources?
With an internal gem server plus rubygems.org, put each internal gem in a source block and give every gem an explicit source. Steps to review a Gemfile.
Oct 18, 20263 min read
Supply Chain
What is the CHECKSUMS section in Gemfile.lock and what does it verify?
Bundler records a CHECKSUMS section in new lockfiles and verifies each gem on install, so a gem altered after locking fails. How to add it to old ones.
Oct 18, 20263 min read
Supply Chain
Gemfile git and path sources: what do they do to dependency scans?
Git and path gems in a Gemfile skip the registry, so version matching gets harder. What Bundler says about them and how to review each one before release.
Oct 18, 20263 min read
Supply Chain
Free SBOM tools vs paid platforms: when free is genuinely enough
An honest look at when free SBOM tools meet your needs and when a paid platform saves real time: team size, product count, audits and customer requests.
Oct 18, 20263 min read
Supply Chain
How do I fix a vulnerable Rust crate with cargo update?
Run a conservative cargo update on the crate, or set an exact version with the precise option, then commit Cargo.lock. Steps, limits and a check for yanks.
Oct 18, 20263 min read
Supply Chain
How do I fix a vulnerable indirect dependency in Go?
Upgrade the vulnerable module with go get and a fixed version, check who needs it, and use replace or exclude only as a last resort. Steps and trade-offs.
Oct 18, 20264 min read
Supply Chain
How do you find vulnerabilities in code copied into your repo?
Vendored and copy pasted libraries hide from lockfile scanners. How to find them, record their origin, and keep them patchable with a simple process.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.