Supply Chain
Blank license or maintainer on a package page: treat it as unknown
A blank license, maintainer or size on a package page means unknown, not fine. How to verify each field and what to do if the data stays missing.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
base_model metadata: tracing fine-tunes, adapters and merges
The base_model field on a Hub model card records lineage. Learn the four relationship types and why each one changes your license and risk review.
Oct 18, 20263 min read
Supply Chain
Autonomous continuous supply chain security, explained plainly
What autonomous and continuous mean for supply chain security, which steps can run unattended, and which should always stay with a named person.
Oct 18, 20263 min read
Supply Chain
A dependency's GitHub repo was archived: what to do next
Archiving makes a repository read only and signals it is no longer maintained. Here is how to decide whether to keep, replace or fork a dependency.
Oct 18, 20263 min read
Supply Chain
Run a vendor risk review on the security tool you are about to buy
A scanner reads your source and secrets, so it needs its own vendor risk review. Here is a short checklist for access, data flow and incident handling.
Oct 18, 20263 min read
Supply Chain
RFP questions to test a tool's SBOM output quality
Eight RFP questions that check whether a tool's SBOM is useful, built on the NTIA minimum elements: data fields, formats, depth, frequency, and known unknowns.
Oct 18, 20264 min read
Supply Chain
Answering SBOM questions in a security questionnaire
Buyers now ask whether you produce an SBOM. How to answer honestly: format, scope, cadence, delivery and what you can promise about vulnerabilities.
Oct 18, 20263 min read
Supply Chain
Amazon Q Developer VS Code extension 1.84.0 incident explained
What AWS said about CVE-2025-8217: malicious code in extension version 1.84.0, why it did not run, and what users and publishers were told to do.
Oct 18, 20263 min read
Supply Chain
Moving a local model onto an offline machine: a transfer checklist
How to bring model files, runtimes and dependencies onto a machine with no internet, with hashes, formats and scanning so the transfer does not add risk.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.