Supply Chain
What does security mode mean for a Python release branch?
A Python branch in security mode gets fixes for exploitable issues only. How branches move from bugfix to security to end of life, and what to plan.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What does resolvedDependencies in provenance tell you, and what not?
resolvedDependencies lists what a build fetched, but SLSA treats its completeness as best effort. Learn how to use it next to an SBOM and dependency scan.
Oct 19, 20263 min read
Supply Chain
What does NVD 'Lowest Priority' or 'Not Scheduled' mean for a CVE?
NVD now enriches CVEs by risk. Here is what Lowest Priority and Not Scheduled mean, what is still enriched first, and how to adjust your scanner.
Oct 19, 20264 min read
Supply Chain
What does npm audit signatures verify, and what does it not?
npm audit signatures checks registry signatures and provenance attestations of downloaded packages. It shows origin and integrity, not that code is safe.
Oct 19, 20263 min read
Supply Chain
What does force-installing a browser extension actually grant it?
Force-installing a Chrome extension installs it silently, blocks removal, and grants extra APIs. Here is what that means for risk and who should own it.
Oct 19, 20264 min read
Supply Chain
What does the Docker Official Images review actually check?
A Docker Official Image passes a maintainer review of its Dockerfile for upkeep, repeatability and safe downloads. It is no vulnerability-free guarantee.
Oct 19, 20264 min read
Supply Chain
What does CRAN check before it accepts an R package?
CRAN expects packages to pass R CMD check as CRAN, with clear ownership and no malicious behavior. Here is what that covers and what it does not.
Oct 19, 20263 min read
Supply Chain
What does an unresolved component mean in a scan or SBOM?
An unresolved component is something a scanner found but could not identify precisely. Why it hides risk and how to count and reduce these gaps.
Oct 19, 20263 min read
Supply Chain
What does a Unity package signature status mean, and what to do?
Unity 6.3 and later check package signatures. What each status means in the Package Manager window and the action Unity recommends for each.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.