Supply Chain
What does SLSA Source Level 4 two-party review require?
SLSA v1.2 Source L4 requires two trusted persons to review changes to protected branches. See what that means, what it does not prove, and how to prepare.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What does SLSA Build L1 'provenance exists' actually give you?
SLSA Build L1 means a build produces provenance naming the output by digest. It is a modest start for inventory and debugging, but not tamper proof.
Oct 19, 20264 min read
Supply Chain
Single maintainer or foundation backed: which is safer to adopt?
Neither is automatically safer. A decision guide for adopting single-maintainer or foundation-backed open source, with the controls each one needs.
Oct 19, 20263 min read
Supply Chain
Should your startup sign its SBOM? The new author signature field
The 2026 CISA minimum elements add an SBOM author signature. What it means, what a startup can honestly say today, and a sensible path to adding one.
Oct 19, 20264 min read
Supply Chain
Should you offer an SBOM before a customer asks for one?
Offering an SBOM early can shorten security reviews if you set terms, delivery and a cover note first. When to offer, how, and when to wait.
Oct 19, 20264 min read
Supply Chain
Should you notify customers when your shared SBOM changes?
Notify customers when a change affects their risk: new release, corrected content, or a component with a serious issue. Skip noise from formatting changes.
Oct 19, 20263 min read
Supply Chain
Should you fork a third-party GitHub Action and use your fork?
Forking an action into your org freezes the code you reviewed, but adds upkeep. When it pays off, how to sync safely, and what a fork does not fix.
Oct 19, 20264 min read
Supply Chain
Should you commit the CocoaPods Pods directory for CI?
Committing the Pods folder makes builds independent of the network and review easier, but bloats the repo. Here is the trade-off and what to do either way.
Oct 19, 20264 min read
Supply Chain
Should you merge an AI fix for a vulnerability your code never reaches?
Reachability changes how much review an AI fix deserves. Learn when to merge a low risk bump, when to defer, and what to record for unreachable code.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.