Supply Chain
Does reachability analysis help when a package is malicious?
Mostly no for the first triage. Malicious code can run at install time, so reachability is for vulnerabilities, not for deciding whether malware ran.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Does npm provenance make an MCP server package safe to run?
No. npm provenance shows where a package was built and who published it, but npm says it does not guarantee the code is clean. How to use it as one signal.
Oct 18, 20263 min read
Supply Chain
Does HIPAA require an SBOM from software vendors?
No HIPAA rule text names an SBOM, yet a component inventory supports the risk analysis the rule does require. Here is how to ask a vendor for one.
Oct 18, 20263 min read
Supply Chain
Does helm verify prove a Helm chart is safe to install?
No. helm verify shows a chart archive matches its .prov file and was signed by a key you trust. It does not tell you whether the chart contents are safe.
Oct 18, 20264 min read
Supply Chain
Does helm upgrade update CRDs? What the crds folder does
Helm installs CRDs on first install but does not upgrade or delete them. Here is what that means for chart updates and how to manage CRDs safely.
Oct 18, 20263 min read
Supply Chain
Does govulncheck report standard library vulnerabilities?
Yes, for source scans it uses the Go version on your PATH, so old toolchains show extra findings. How the go and toolchain lines affect what you see.
Oct 18, 20263 min read
Supply Chain
Does go get run code from a dependency when you install it?
Fetching and building Go modules runs no install scripts by design, but init functions run in your program, and go generate or cgo need your attention.
Oct 18, 20263 min read
Supply Chain
Does CMake FetchContent hide dependencies from vulnerability scanners?
Libraries declared in CMake code have no lockfile entry, so manifest-based scans can miss them. How to list them and get them into your inventory.
Oct 18, 20263 min read
Supply Chain
Does Cargo run code from dependencies through build.rs?
Cargo compiles and runs a crate's build.rs before building it. Here is what that means for dependencies, what to review, and how to limit the exposure.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.