Supply Chain
What should a provenance file for vendored code record?
A short file beside vendored code can answer where it came from, which version, what you changed and when to update. Here are the fields worth writing.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
A vendor sent you an SBOM: what do you check first?
Five quick checks on a vendor SBOM before you trust it: required fields, version match, depth, known unknowns and a vulnerability scan. Steps for buyers.
Oct 19, 20264 min read
Supply Chain
Who should have write access to a vcpkg binary cache?
A vcpkg binary cache holds built packages that others restore. Learn why CI should write, developers should read, and how this limits a poisoned cache.
Oct 19, 20263 min read
Supply Chain
Upstream archived its repo: what does that mean for your fork?
An archived repo is read only, so your fork now owns every future fix. Your options: adopt it, replace it or freeze it. How to choose between them.
Oct 19, 20264 min read
Supply Chain
Do unscoped internal package names risk dependency confusion?
Yes. A public package can shadow an unscoped internal name. Use a scope you control, the workspace protocol and a claimed namespace to avoid it.
Oct 19, 20264 min read
Supply Chain
How do you identify unknown binaries found during an inventory review?
Hash the file, search metadata and strings, find the build recipe, and replace what cannot be identified. A step by step path for unknown binaries.
Oct 19, 20263 min read
Supply Chain
Is Ubuntu 22.04 still safe as a container base image in 2026?
Canonical lists 22.04 standard security maintenance until May 2027. How to plan a base image move to 24.04 or 26.04 with a simple, dated timeline.
Oct 19, 20264 min read
Supply Chain
Why do two advisory databases disagree on which versions are affected?
Two databases can list different affected versions for one flaw. See how fixed, last affected and version lists change whether your version gets flagged.
Oct 19, 20264 min read
Supply Chain
How do you turn a supplier SBOM finding into a ticket someone acts on?
A good ticket names the product, component, exposure, owner and deadline. A template for turning supplier SBOM findings into actionable work.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.