Supply Chain
Polyglot dependency hygiene: seven myths and what the docs say
Seven common beliefs about lockfiles, hashes, audits and install scripts in many languages, checked against each tool's official documentation.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Policy, standard, procedure, guideline: what goes where?
Keep the supply chain policy short and stable, put measurable rules in standards, steps in procedures and advice in guidelines. Here is how to sort it.
Oct 19, 20263 min read
Supply Chain
What if two companies' dependency rules disagree? A conflict matrix
When merged teams have conflicting dependency rules, classify each conflict by cost and risk, then pick strict, staged, or exempt. A simple matrix to use.
Oct 19, 20264 min read
Supply Chain
What does pnpm trustPolicy no-downgrade block?
pnpm trustPolicy no-downgrade fails an install when a package's trust evidence drops versus earlier releases. What it checks, misses, and how to adopt it.
Oct 19, 20264 min read
Supply Chain
Why does pnpm ignore my .npmrc token with an environment variable?
Newer pnpm does not expand environment variables in credential lines of a project .npmrc, so malicious repos cannot take CI tokens. How to supply them.
Oct 19, 20263 min read
Supply Chain
How do you set pnpm minimumReleaseAge, and what does strict mean?
pnpm minimumReleaseAge delays new versions by minutes. How the 1440 default, strict mode, excludes and missing publish dates actually behave in pnpm 11.
Oct 19, 20264 min read
Supply Chain
What does pnpm blockExoticSubdeps do to git and tarball URL dependencies?
blockExoticSubdeps lets only your own package.json use git or tarball URLs. Transitive dependencies need a trusted source. What it blocks and how.
Oct 19, 20263 min read
Supply Chain
Plugins installed after deploy: where dependency scanners go blind
Plugins added through an admin interface never appear in your repository, so manifest scans miss them. How to inventory runtime installed extensions.
Oct 19, 20263 min read
Supply Chain
How do you pin Python requirements with hashes in pip?
To pin Python requirements with hashes, use exact versions plus a hash per package and enable hash-checking mode. Here is how it works and what it covers.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.