Supply Chain
What does registry proxy scanning catch that CI scanning misses?
A registry proxy decides before a package is downloaded, so it covers laptops, install scripts and unmanaged machines that CI scanning never sees.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What permissions should a release workflow have in GitHub Actions?
Default to read only, then grant write scopes to the single job that publishes. GitHub advises giving the GITHUB_TOKEN the least access a job needs.
Oct 19, 20264 min read
Supply Chain
What open source material belongs in a deal data room?
A seller's data room should hold a component inventory, build and deploy proof, license and vulnerability records, and ownership notes. Here is the index.
Oct 19, 20264 min read
Supply Chain
What does NVD's 'Lowest Priority' label mean for your scanner findings?
NVD now labels many CVEs Lowest Priority and not scheduled for enrichment. What that does to scanners that rely on NVD data alone, and what to do about it.
Oct 19, 20264 min read
Supply Chain
What does npm provenance require, and what does it make public?
npm provenance needs a supported cloud CI, a public repository field, id-token permission and npm 9.5.0 or newer. It also logs a public build record.
Oct 19, 20263 min read
Supply Chain
What does npm audit signatures verify, and where does it fit in intake?
npm audit signatures checks registry signatures and provenance on downloaded packages. Here is what it proves, what it does not, and where to run it.
Oct 19, 20263 min read
Supply Chain
What is the OSPS Baseline, and how can dependency consumers use it?
The Open Source Project Security Baseline is a set of controls by maturity level. What it contains, how versions work, and how consumers can read results.
Oct 19, 20263 min read
Supply Chain
What is software supply chain governance, and how is it different?
Supply chain governance sets who decides, by what rules, and who answers for third-party software risk. It differs from security tooling and compliance.
Oct 19, 20264 min read
Supply Chain
What is S2C2F? Eight practices for consuming open source securely
S2C2F is an OpenSSF framework for how developers consume open source. Its eight practices run from ingest and scan to enforce, rebuild and fix.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.