Supply Chain
Unpublish, yank or deprecate: how registries pull a bad release
Registries offer three ways to retire a release: unpublish, yank and deprecate. Compare what each does to new installs, lockfiles and cached copies.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
ua-parser-js 2021: three bad versions and what to rotate
Three ua-parser-js releases carried a miner and a password stealer in October 2021. Affected versions, the install script trick and the cleanup list.
Oct 18, 20263 min read
Supply Chain
Reflections on Trusting Trust: the compiler backdoor, explained
Ken Thompson showed that clean source code can still produce a backdoored program. This explainer covers the idea and the diverse double-compiling defence.
Oct 18, 20264 min read
Supply Chain
What is a transitive dependency and why does it matter?
A transitive dependency is a package your code needs only because another dependency needs it. Learn why they hold most of your risk and how to see them.
Oct 18, 20263 min read
Supply Chain
Three kinds of open source risk: vulnerable, abandoned, malicious
Open source risk is not one thing. Vulnerable, abandoned and malicious packages need different detection and responses, and scanners mostly cover one.
Oct 18, 20263 min read
Supply Chain
Third party SDKs in games and creator apps: what to check
Ad, analytics and social SDKs run with your app's permissions. Inventory them, limit data, pin versions and review changes before each release.
Oct 18, 20263 min read
Supply Chain
Third-party AI risk: how to review vendors, models and data
AI vendors, hosted models and training data are supply chain risks. What the NIST AI RMF and generative AI profile say to inventory, monitor and plan for.
Oct 18, 20263 min read
Supply Chain
Should you commit .terraform.lock.hcl? Yes, and here is why
Commit the Terraform lock file. It pins provider versions and checksums, so any provider change shows up in code review. How it works and where it stops.
Oct 18, 20263 min read
Supply Chain
T1195 supply chain compromise: what developers can actually do
MITRE T1195 lists where software supply chains get tampered with and six mitigations. Here is how each one translates into daily developer work.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.