Supply Chain
What should a VEX follow-up after a customer notice contain?
After the first notice, send VEX updates as verdicts settle: version the document, bump timestamps, add action statements and say what changed.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you vet a package your AI coding tool added in five minutes?
A five-minute check for any package an AI tool added: does it exist, is it needed, who maintains it, is it pinned, and does it run install scripts?
Oct 19, 20264 min read
Supply Chain
How should you version SBOMs and evidence you share with customers?
Give every shared SBOM and evidence file a release tied version, an as-of date and a short changelog so customers can tell which copy is current.
Oct 19, 20264 min read
Supply Chain
Can you verify upstream tags are signed before syncing your fork?
Git can check a tag's GPG signature before you sync. That proves who signed it, not that the code is safe. Here is a short routine and its limits.
Oct 19, 20264 min read
Supply Chain
How do you verify the package version an AI fix recommends?
Check that an AI recommended package and version exist, sit at or above the fixed version in the advisory, and match what your lockfile actually resolves.
Oct 19, 20263 min read
Supply Chain
How do I verify resolved versions after switching package managers?
Export name and version pairs from the old and new lockfile, diff them, and explain every difference before a package manager migration merges.
Oct 19, 20264 min read
Supply Chain
How do you verify an open source scanner before running it in CI?
A scanner runs with access to your code and tokens. Verify its release with signatures or attestations first. Here are the steps and their limits.
Oct 19, 20264 min read
Supply Chain
How can a customer verify the SBOM you sent was not altered?
Publish a SHA-256 checksum for a quick integrity check, or sign the SBOM file with a tool such as cosign so the customer can verify who issued it.
Oct 19, 20263 min read
Supply Chain
How do you verify a scanner binary before running it in CI?
A scanner in your pipeline holds your tokens. Steps to verify downloads: pin versions, check signatures and provenance, and what the checks do not prove.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.