Supply Chain
What does a removed component in an SBOM diff mean?
A component missing from the newer SBOM is either a good cleanup or a generation gap. Here is how to tell which one, and what to check before celebrating.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What do we tell commercial component suppliers under SSDF PO.1.3?
SSDF PO.1.3 asks you to communicate security requirements to third parties whose commercial components you reuse. What to send and what to keep.
Oct 19, 20264 min read
Supply Chain
What do PyPI attestations prove for a scientific Python package?
PyPI attestations tie a release file to a signing identity such as a GitHub Actions workflow. What that proves, what it does not, and how to use it.
Oct 19, 20263 min read
Supply Chain
What do npm trusted publishers mean for someone adopting a package?
Trusted publishing replaces long-lived npm tokens with short-lived workflow credentials. What that means for your vetting, and what it still leaves open.
Oct 19, 20263 min read
Supply Chain
What do customers actually do with an SBOM you send them?
After you send an SBOM, customers load it into tools, match it to advisories and check licenses. Knowing the uses helps you prepare better answers.
Oct 19, 20264 min read
Supply Chain
What should developers be taught about open source dependencies?
A training outline on open source dependencies: choosing packages, lockfiles, updates, transitive risk and reading advisories. Five lessons with exercises.
Oct 19, 20263 min read
Supply Chain
What dependency risk signals exist beyond CVEs?
CVEs only list known flaws. Five other signal groups, maintenance, release behavior, review practice, provenance and adoption, show how a dependency is run.
Oct 19, 20263 min read
Supply Chain
What data leaves your network during a dependency scan?
A dependency scan can send package names and versions, sometimes more. Here is what to check so you know what leaves your network and why.
Oct 19, 20264 min read
Supply Chain
What counts as a malicious package in the OpenSSF reports repository?
The OpenSSF repository defines a malicious package by incident response need, not nuisance. Typosquats, obfuscation and security tools differ.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.