Supply Chain
How do you prove dependency scanning runs on every build?
Buyers ask for proof that dependency scanning is real. Here is what evidence a SaaS startup can show: pipeline config, run logs and a blocked build.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you prove a build pulled packages from your internal mirror?
A configuration file is a claim, not proof. Four pieces of evidence show a regulated build fetched dependencies from the internal mirror and nowhere else.
Oct 19, 20263 min read
Supply Chain
How do you stop release tags from being moved or deleted on GitHub?
A tag ruleset controls who can delete or rename tags. Nine steps to create one, which tags to target, and why a moved tag breaks the trust in a release.
Oct 19, 20263 min read
Supply Chain
How do you protect internal Python package names from lookalikes?
A decision guide for private Python package names: one index, a proxy, a public placeholder, or hashes. Pick by how your team installs packages.
Oct 19, 20264 min read
Supply Chain
How do you stop an app from being published to npm by accident?
Set private true in package.json so npm refuses to publish an app, and use the files field to control exactly what ships in a library tarball.
Oct 19, 20263 min read
Supply Chain
Checklist: securing a private custom OpenAPI generator
If your team builds its own generator as a JAR on the classpath or a plugin dependency, here is a checklist for versioning, review, storage and scanning.
Oct 19, 20263 min read
Supply Chain
What do Prefect pull steps run, and how do you keep them repeatable?
Prefect pull steps clone code and install requirements each time a deployment runs. A branch or loose requirements file means runs can differ. Pin both.
Oct 19, 20264 min read
Supply Chain
Do preapproved libraries speed up delivery and cut security risk?
DORA suggests security teams offer preapproved libraries and tools. How an approved list works, what to put on it, and how to measure that it helps.
Oct 19, 20264 min read
Supply Chain
How do you write a postmortem when the bad package was deleted?
When a registry removes a malicious package, your own records become the evidence. How to reconstruct what ran from lockfiles, logs and caches.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.