Supply Chain
How old can an SBOM be before it stops counting in a deal?
An SBOM goes stale at the next build or the next advisory. Check the timestamp against the release, and rescan old files before relying on their findings.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How often should a healthy dependency publish releases?
There is no ideal release cadence. Read the rhythm against the package's job, then watch for a change in pattern rather than a number.
Oct 19, 20263 min read
Supply Chain
How do you check how much a library pulls in before adopting it?
Check a library's dependency footprint before adopting it: count transitive packages, see who maintains them, and decide if the extra surface is worth it.
Oct 19, 20264 min read
Supply Chain
How many reviewers does a dependency need? Reading review signals
Review practice shows how hard it is to slip a bad change into a project. How to read Code-Review, Branch-Protection and Contributors results fairly.
Oct 19, 20264 min read
Supply Chain
How many dependencies should a CLI have? Set a budget
There is no magic number. Set a dependency budget, require a reason for each addition and track transitive packages, since each is code your users run.
Oct 19, 20263 min read
Supply Chain
How long does each Kubernetes minor version get patches?
Kubernetes supports a patch series for roughly 14 months: 12 standard plus 2 in maintenance mode. What each period covers and how to plan upgrades.
Oct 19, 20264 min read
Supply Chain
How long does a framework promise security fixes? A Rails example
How long Rails promises bug fixes and security fixes, why the two clocks differ, and what dependents should do when a release series reaches end of life.
Oct 19, 20265 min read
Supply Chain
How fresh is a scanner's advisory data? A PoC test
Test how quickly a dependency scanner picks up new advisories: pick recent ones, log the lag against public databases, and set a tolerance before the PoC.
Oct 19, 20264 min read
Supply Chain
How do force-installed browser extensions get updates?
Chrome checks an update URL every few hours and installs newer versions signed with the same key. Here is how store and self-hosted updates differ.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.