Supply Chain
3CX and X_TRADER: a valid code signature is not a safety check
Mandiant traced the 3CX build compromise to a signed, tampered installer from another vendor. What a signature proves, and what it never did.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Which type of SBOM should you ask a supplier for?
Ask for a build SBOM when you can get one, an analyzed SBOM when you cannot, and ask the supplier to label the type. A decision guide for buyers.
Oct 18, 20263 min read
Supply Chain
Who should author VEX: the supplier, you, or a third party?
CISA allows VEX from suppliers or third parties. A decision guide on who is best placed to write each statement, and how to record your own VEX internally.
Oct 18, 20263 min read
Supply Chain
Why open source is not automatically safe, and the xz lesson
Open source can be reviewed by anyone, but that does not mean it is reviewed. What the xz incident showed about trust, and what to do about it.
Oct 18, 20263 min read
Supply Chain
How to write a useful VEX action statement for an affected product
An affected VEX statement must say what to do. How to write action statements that name versions, workarounds and timing, with weak and strong examples.
Oct 18, 20263 min read
Supply Chain
The xz backdoor was found through half a second of SSH delay
A developer chasing odd CPU use and slow SSH logins found the xz backdoor (CVE-2024-3094). What the discovery shows about performance as a security signal.
Oct 18, 20263 min read
Supply Chain
xz Utils: why the backdoor lived in the release tarball, not git
The xz backdoor build script sat in release tarballs but not in git. Here is why that gap matters and how to compare tarballs with source tags.
Oct 18, 20264 min read
Supply Chain
The XZ Utils backdoor as a story about maintainer pressure
The 2024 XZ Utils backdoor (CVE-2024-3094) was found by accident. The human side: how maintainer trust was gained and how the flaw came to light.
Oct 18, 20263 min read
Supply Chain
Your npm account was compromised: a runbook for the maintainer
If someone published a malicious version of your npm package: lock the account, warn users, deprecate or unpublish, and move to safer publishing.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.