Supply Chain
What does Xcode SDK signature validation check?
Xcode validates that a new SDK version was signed by the same developer as before. That helps integrity but is not a security review. Where it fits.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What does unknown mean in an SBOM you send a customer?
In an SBOM, unknown means the author lacks the data and withheld means they chose not to share it. How to explain each to a customer, and what to avoid.
Oct 19, 20264 min read
Supply Chain
What does the VS Code Marketplace check before an extension goes live?
The VS Code Marketplace scans for malware, signs packages and blocks name theft. See what each check covers, and the gaps you still have to close yourself.
Oct 19, 20264 min read
Supply Chain
What does the Update URI header do for custom WordPress plugins?
The Update URI header stops WordPress.org from overwriting a custom plugin that shares a slug with a directory plugin. How to set it and what it misses.
Oct 19, 20264 min read
Supply Chain
What does the Terraform dependency lock file protect, and what not?
The .terraform.lock.hcl file records provider versions and checksums with trust on first use. It does not cover modules. What to commit and review.
Oct 19, 20264 min read
Supply Chain
What does the Spark packages option download at submit time?
The Spark packages option resolves Maven coordinates and all transitive dependencies at submit time. Here is what that means for pinning and credentials.
Oct 19, 20264 min read
Supply Chain
What does the OpenSSF Best Practices badge tell you about a project?
The OpenSSF Best Practices badge shows a project self-certified against a practice list. What it proves, what it does not, and how to use it in a review.
Oct 19, 20264 min read
Supply Chain
What does it mean when an Apache project moves to the Attic?
An Apache project in the Attic has reached end of life, with no new releases or bug fixes expected. Here is what that means for dependencies you still use.
Oct 19, 20264 min read
Supply Chain
What does SLSA mean when a software vendor mentions it?
SLSA is a set of guidelines for how software is built and delivered. A level claim says how well the build was protected, not whether the code is flawless.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.