Supply Chain
How to know if you run the component named in the news
When a library or product is in the headlines, you need to know in minutes whether you ship it. Here is how to search code, builds, images and vendors.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How a scanner links a CVE to a specific vulnerable function
Reachability needs to know which function is vulnerable. See where that symbol data comes from, why it is missing for many CVEs, and what scanners do then.
Oct 18, 20263 min read
Supply Chain
How often should you regenerate an SBOM?
Regenerate an SBOM for every build or release, and rescan stored SBOMs as new advisories appear. Here is the reasoning and a simple schedule.
Oct 18, 20263 min read
Supply Chain
How model signing and verification work, step by step
Model signing hashes every file in a model folder, signs the list, and lets a consumer re-hash and check it. Here is the flow and what each step proves.
Oct 18, 20263 min read
Supply Chain
An open source usage policy for government contractors: a checklist
A short open source policy for teams that build software for government customers: intake, approval, inventory, updates and what to record for audits.
Oct 18, 20263 min read
Supply Chain
GlassWorm: the invisible-code VS Code extension worm and how to defend
GlassWorm, found in October 2025, hid malicious code in invisible Unicode and spread through VS Code extensions. What it did and how to defend your editor.
Oct 18, 20263 min read
Supply Chain
GitHub Advisory Database: reviewed, unreviewed and malware advisories
The GitHub Advisory Database has three advisory types. See what reviewed, unreviewed and malware entries mean and which ones trigger Dependabot alerts.
Oct 18, 20263 min read
Supply Chain
Inventory the engine, middleware and asset packs in your game
Games ship engines, plugins, asset packs and SDKs that scanners miss. Build an inventory of all of them so you can answer what is in this build.
Oct 18, 20263 min read
Supply Chain
Fourth-party risk explained: your vendors' vendors
Fourth-party risk is the exposure that comes from the suppliers your suppliers rely on. Learn how to find them, what to ask, and what contracts can cover.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.