Supply Chain
Checking mobile app libraries for known vulnerabilities
MASVS-CODE-3 asks that a mobile app uses only components without known vulnerabilities. How to inventory the libraries in an app build and keep that true.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How Maven Central verifies a groupId, and what to check yourself
Maven Central ties a groupId to a domain you control or a hosting account. See how that proof works and how to read a groupId before trusting a library.
Oct 18, 20263 min read
Supply Chain
How to match VEX statements to the components in your SBOM
VEX only helps if its product identifiers line up with your SBOM. How package URLs, hashes and subcomponents link the two, and what to do on a mismatch.
Oct 18, 20263 min read
Supply Chain
Managed open source: what you outsource and what you keep
Managed open source shifts patching and curation work to a provider, but not accountability. A plain look at what moves and what stays with you.
Oct 18, 20264 min read
Supply Chain
Malware screening vs vulnerability scanning: two different checks
Vulnerability scanning finds known flaws in honest code. Malware screening looks for code built to harm. Why a package needs both and how to read each.
Oct 18, 20263 min read
Supply Chain
Maintainer health signals to check before adopting a dependency
Which signals show that an open source project can sustain itself and resist abuse, and how to check them in a few minutes using public data and tools.
Oct 18, 20263 min read
Supply Chain
LoRA adapters and model merges: who are you trusting?
Small adapters and merged models are easy to share and hard to audit. The supply chain risks OWASP lists and how to keep an approved sources list.
Oct 18, 20263 min read
Supply Chain
Log4Shell had four fix versions. Here is why and which to run
Log4Shell needed 2.15.0, 2.16.0, 2.17.0 and 2.17.1 to close related flaws. Each version explained, plus the early workaround that was not enough.
Oct 18, 20263 min read
Supply Chain
Log4j had three CVEs in a week: why one patch was not enough
Within a week of Log4Shell, two more Log4j CVEs followed. See the dates, what each fixed and how to plan for follow-up releases after a big disclosure.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.