Supply Chain
What happens when a maintainer moves a git tag you already pulled?
Git does not silently change a tag you already have. You can end up with two different things called the same version, so pin by commit hash.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What happens to your analysis when CRAN archives an R package?
CRAN rarely removes packages but may archive them, for example after check errors on a new R release. What it means for your project and how to prepare.
Oct 19, 20263 min read
Supply Chain
What do you do when an open source component reaches end of life?
Customers ask about end of life dependencies. Answer with detection, a plan per component, and the options of upgrade, replace, fork or accept with a date.
Oct 19, 20263 min read
Supply Chain
What happens when a GitHub Action's repository is renamed?
GitHub does not redirect calls to a renamed action, so workflows fail. Why that matters for builds and for name reuse, and how to plan for it.
Oct 19, 20264 min read
Supply Chain
What happens to your build when a Hugging Face model repo moves?
When a model repo is renamed, transferred or made private, your pinned name may redirect or return 404. What the docs say and how to protect a build.
Oct 19, 20264 min read
Supply Chain
What goes in an SBOM for a WordPress site?
A WordPress site SBOM should list core, plugins, themes, must-use plugins, drop-ins and Composer libraries with versions and sources. A field guide.
Oct 19, 20264 min read
Supply Chain
What should an offline fallback bundle for CI builds contain?
An offline fallback bundle lets you build when registries are unreachable. A checklist: lockfiles, packages, images, build tools and scan data.
Oct 19, 20264 min read
Supply Chain
What goes in a software supply chain security charter?
A supply chain security charter is a one to two page document naming purpose, scope, owner, decision rights, cadence and escalation. Here is what to write.
Oct 19, 20264 min read
Supply Chain
What events should trigger a re-review of an adopted dependency?
Re-review an approved dependency when owners change, a new advisory lands, releases go quiet, workflows change or your use of it grows. A trigger list.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.