Supply Chain
crates.io trusted publishing: publish by hand once, then use OIDC
How crates.io trusted publishing replaces a stored API token with a short-lived one from GitHub Actions, and the first-release step people miss.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What do you do when you find a mistake in an SBOM you already shared?
How to correct an SBOM you already sent: issue a revised file, tell recipients, keep the old one, and record what changed. Based on NTIA guidance.
Oct 18, 20263 min read
Supply Chain
Copied code and your SBOM: track borrowed code as a dependency
Code pasted from another project never appears in a dependency file. CISA's 2026 SBOM guidance suggests recording it as a named local fork with a link.
Oct 18, 20264 min read
Supply Chain
Should you convert SBOMs to one format when they arrive?
Converting every SBOM to one format simplifies processing but can drop fields. Compare convert on intake, keep native, and the hybrid most teams settle on.
Oct 18, 20263 min read
Supply Chain
Continuous monitoring vs point-in-time scans: what to evaluate
Point-in-time scans find issues at build. Continuous monitoring catches advisories published later. How to decide what you need and how to test either.
Oct 18, 20263 min read
Supply Chain
Container image scanning evaluation checklist for buyers
Evaluate container scanners with real images: OS and language package coverage, layer attribution, registry fit, speed and SBOM output quality.
Oct 18, 20263 min read
Supply Chain
A maintainer account is hijacked: which controls limit the damage?
When a trusted maintainer account ships a bad release, four controls shrink exposure: inventory, version delay, short-lived publish tokens and monitoring.
Oct 18, 20263 min read
Supply Chain
How do Composer canonical, only and exclude stop dependency confusion?
Composer 2 repositories are canonical by default, and the only and exclude options narrow what each can serve. Setup steps to block name confusion.
Oct 18, 20263 min read
Supply Chain
What is Composer allow-plugins and why does it ask me to trust a package?
allow-plugins is a Composer setting, added in 2.2.0, that lists which plugins may run code inside Composer. Here is how to review and set it safely.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.