Supply Chain
How do you find every repository a target company really has?
Do not rely on the seller's list. Enumerate repositories from the source host, CI, registries and deployed workloads, then reconcile the four lists.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do I find container images pulled from unapproved registries?
Read the registry host from every image reference in Dockerfiles and manifests. Images with no host default to the public registry. How to search and fix.
Oct 19, 20264 min read
Supply Chain
How do you explain VEX statuses to support and sales teams?
VEX statuses say whether a product is affected by a known vulnerability. A plain guide to the four values for support and sales, with wording to use.
Oct 19, 20263 min read
Supply Chain
How do you describe a forked component in a CycloneDX SBOM?
CycloneDX has a pedigree field for forks. Use ancestors for the original project, and commits or patches for what you changed. Here is what to fill in.
Oct 19, 20264 min read
Supply Chain
How do you count a vulnerability: by CVE, package, instance or fix?
One library flaw can show up as hundreds of rows. Learn the four counting units, what each one measures and which to put on a security dashboard.
Oct 19, 20264 min read
Supply Chain
How do you check a firmware component still gets security fixes?
Before you build on a library or SDK, check whether it still receives security updates. Six quick signals a hardware startup can check in an afternoon.
Oct 19, 20263 min read
Supply Chain
How do you check if a public image ships provenance and SBOM data?
Inspect the image index in the registry for attestation manifests, then read provenance and SBOM data with docker buildx imagetools inspect before adopting it.
Oct 19, 20264 min read
Supply Chain
How do you track deprecations across your dependencies?
A simple deprecation tracker has four inputs and one owner per entry. Learn what to record, where signals come from and how to keep it from going stale.
Oct 19, 20264 min read
Supply Chain
How do you build a dependency inventory for an ML project?
An ML dependency inventory lists packages, model files, datasets and notebooks, not just pip libraries. Here is a step by step method and a template.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.