Supply Chain
How do you check for end-of-life runtimes every quarter?
List every language runtime, framework and base image you run, look up each support end date, and schedule upgrades. A quarterly routine for small teams.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What must be true before a quarantined package is promoted?
A quarantined dependency should leave only when named criteria are met. Here is a release checklist covering age, scans, source, behaviour and sign-off.
Oct 19, 20263 min read
Supply Chain
Are Python packages installed with apt missed by a pip scan?
Python libraries installed through the OS package manager do not appear in requirements files, so a pip focused scan misses them. Where to look instead.
Oct 19, 20263 min read
Supply Chain
Is the build-system table in pyproject.toml part of your supply chain?
Yes. The requires list names tools that run when your package is built, on your machine and for users installing from source. Keep it small and reviewed.
Oct 19, 20263 min read
Supply Chain
Is reading Parquet or Feather files with old PyArrow a risk?
An advisory covers deserialization in PyArrow IPC and Parquet readers from 0.14.0 to 14.0.0. Who is exposed, how to check your version, and the fix.
Oct 19, 20264 min read
Supply Chain
A package's namespace or supplier changed in an SBOM diff: what now?
When a package name stays but its namespace or supplier changes between releases, check for a rename, fork swap or lookalike before you accept it.
Oct 19, 20263 min read
Supply Chain
Should you remove unused dependencies before upgrading the rest?
Yes. Every dependency you delete is an upgrade you never do. Here is a quarterly pruning pass that shrinks the upgrade backlog before work begins.
Oct 19, 20264 min read
Supply Chain
What provider version constraint should a shared Terraform module use?
Shared Terraform modules should set only a minimum provider version with >=, while root modules pin with ~>. Why the split exists and how to review it.
Oct 19, 20264 min read
Supply Chain
What do provenance, attestation, predicate and subject mean in a build?
Four build terms in plain English: provenance is the build record, an attestation a signed claim, the subject the artifact, the predicate the claim itself.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.