Supply Chain
Who should own software supply chain risk in an enterprise?
One executive should be accountable, a small central team should coordinate, and engineering teams should own their components. Here is how to split it.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Who should generate build provenance, your scripts or the platform?
At higher SLSA levels the build platform, not your build steps, must generate and sign provenance. Here is why and what that means for your pipeline.
Oct 19, 20264 min read
Supply Chain
Who patches a custom jlink Java runtime inside your container?
You do. The jlink documentation says developers are responsible for updating custom runtime images. How to build a process that rebuilds on every JDK fix.
Oct 19, 20264 min read
Supply Chain
Who owns a groupId on Maven Central? Namespace verification
Maven Central ties a groupId to a verified domain or hosting account. What the check proves, what it does not, and how to read a groupId safely.
Oct 19, 20264 min read
Supply Chain
Who keeps a scanner's vulnerability data fresh, and how do you check?
A scanner is only as current as its data feed. Who maintains that feed in open source versus managed setups, and how to test freshness yourself.
Oct 19, 20264 min read
Supply Chain
Who is the author in an SBOM: the software maker or the data source?
In the NTIA minimum elements, Author of SBOM Data names who produced the SBOM record, not who wrote the software. Here is how to read and fill it in.
Oct 19, 20264 min read
Supply Chain
Who is responsible for a vulnerability in open source you ship?
When you ship open source in a product, customers look to you. The maintainer wrote the code, but you chose it and decide when the fix arrives.
Oct 19, 20263 min read
Supply Chain
Where does conda read its settings, and who can change your channels?
Conda merges settings from many condarc locations, environment variables and flags. Learn the order, and how to see which file set your channel list.
Oct 19, 20263 min read
Supply Chain
Who can push new code to your users through a plugin update?
Every plugin update path is a way for someone else to change code you approved. Map who controls each path and which controls can slow a bad update.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.