Supply Chain
What is a libyear, and should you track dependency freshness?
A libyear measures how far behind your dependencies are, in years. Learn how to read it, where it misleads, and how to use it for upgrade planning.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What is a hybrid dependency scanning model and who needs one?
A hybrid model splits scanning between your own network and a hosted service. Here is what runs where, the trade offs, and who benefits.
Oct 19, 20263 min read
Supply Chain
What is a GPG revocation certificate and when should you create it?
A revocation certificate lets you declare a key invalid if it is lost or stolen. Create it when you create the key and store it apart from the key.
Oct 19, 20264 min read
Supply Chain
What is a fourth party, and will a buyer ask about yours?
A fourth party is a supplier of your supplier. Learn why enterprise buyers ask, what a startup can know about them, and how to answer honestly.
Oct 19, 20264 min read
Supply Chain
What is a dependency exit plan and what should it say?
A dependency exit plan says how you would replace or fork a package if it is abandoned, hijacked or banned. Template, triggers and a worked structure.
Oct 19, 20264 min read
Supply Chain
What if the package registry itself is compromised?
If a registry or mirror serves tampered packages, recorded hashes and provenance help you notice. Learn which checks still work when you cannot trust it.
Oct 19, 20263 min read
Supply Chain
What if a dependency vanishes from the registry? Can you still build?
If a package is removed or a registry is down, a lockfile alone will not rebuild your release. Keep a verified copy: a mirror, a cache or vendored source.
Oct 19, 20264 min read
Supply Chain
What if a customer wants an SBOM in a format you do not produce?
If a customer asks for SPDX and you make CycloneDX, or the reverse, convert carefully, validate the output and say it was converted. Steps and limits.
Oct 19, 20264 min read
Supply Chain
What happens when a maintainer transfers a package to the npm account?
npm lets a maintainer who walks away hand a deprecated package to the registry account. After that nobody can publish updates. What dependents should do.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.