Supply Chain
What changes when a Lambda function uses a non-AWS base image?
A non-AWS base image on Lambda means you supply the runtime interface client and own operating system patching. A checklist for owning that image.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What do certificate identity and issuer mean when verifying a release?
In keyless signing the identity says who signed and the issuer says which login provider vouched. Verify with both named, or the check proves little.
Oct 19, 20263 min read
Supply Chain
What can an Atlassian Forge app not do? Runtime limits explained
Forge apps run in isolated runtimes with declared scopes and egress. See what they cannot do, and which questions still belong in your marketplace review.
Oct 19, 20264 min read
Supply Chain
What can a Babel plugin or preset do to your build?
A Babel plugin or preset is an npm package that rewrites your code at build time. It can change what ships and run with full access to the build machine.
Oct 19, 20264 min read
Supply Chain
What belongs in a Helm chart SBOM?
A Helm chart SBOM should cover chart dependencies, the container images the chart deploys, and the chart itself. Here is how to build and check one.
Oct 19, 20263 min read
Supply Chain
What should you diff a new SBOM against: last release or main?
Pick your SBOM baseline by the question: last release for what shipped, main for what is coming, production for what runs. A short decision table.
Oct 19, 20263 min read
Supply Chain
What are WordPress mu-plugins and who should own them on client sites?
Must-use plugins load on every request, hide from the normal list and skip update notices. Here is what that means for agencies and how to keep them owned.
Oct 19, 20263 min read
Supply Chain
What are WordPress drop-ins and why list them in a plugin audit?
Drop-ins like object-cache.php replace core behavior and sit outside the normal plugin list. Here is how to find them and keep them in your inventory.
Oct 19, 20263 min read
Supply Chain
What are artifact attestations and do small teams need them?
Artifact attestations are signed claims about where and how a build was made. They only help when someone verifies them. A plain guide for small teams.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.