Supply Chain
Should tutorials pin dependency versions, and how?
Yes. Tutorials should ship a lockfile and tell readers to install from it, so a sample keeps working and a hijacked release cannot slip in later.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Should the bootloader be listed in your firmware SBOM?
Yes, list the bootloader and its libraries. It runs first, holds trust decisions and has its own advisories. See what to record and who owns each part.
Oct 19, 20263 min read
Supply Chain
Should a deploy gate require an SBOM or attestation on the image?
A deploy gate can require that an image carries a signed SBOM or other attestation. What it proves, what it does not, and how to roll the rule out.
Oct 19, 20264 min read
Supply Chain
Should CI fall back to the public registry when the mirror is down?
Falling back to the public registry keeps builds green but can bypass your intake rules. Here is when it is safe, when it is not, and how to decide.
Oct 19, 20264 min read
Supply Chain
Should an SDK have zero dependencies? Trade-offs for API publishers
Fewer dependencies mean a smaller attack surface for customers, but zero is not always wise. How to decide what to keep, bundle, or make a peer dependency.
Oct 19, 20264 min read
Supply Chain
Should an agency fork an open source package for a client?
Forking an open source package gives control and creates a maintenance duty. A decision guide for agencies: when to fork, patch, wait or replace.
Oct 19, 20263 min read
Supply Chain
Should a Wi-Fi or Bluetooth module's firmware blob be in your SBOM?
Radio modules often ship closed firmware. List it anyway with supplier, version and hash, and mark the contents unknown. Here is how to record it.
Oct 19, 20263 min read
Supply Chain
Should a tutorial add a dependency for five lines of code?
Each package a tutorial installs adds code readers must trust and update. A decision guide for when to write the lines and when to use a library.
Oct 19, 20264 min read
Supply Chain
Should a provenance verifier ignore or reject unknown fields?
SLSA says to ignore unrecognized fields in general but reject unexpected ones in externalParameters. Learn why the two rules differ and how to code both.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.