Supply Chain
How can I tell if an open source project is still maintained?
Check for recent activity, a security policy, signed releases and an update routine. OpenSSF Scorecard turns several of these into automatic checks.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How can I tell if a vendor keeps the parts inside its software current?
Ask for an SBOM, check its date and versions, and ask how often components are scanned. Here is a short list of questions that reveal the habit.
Oct 19, 20264 min read
Supply Chain
Hosted or shipped software: what changes in inventory questions?
For shipped software, ask what is in each release customers hold. For hosted software, ask what runs now. The inventory scope and questions differ.
Oct 19, 20263 min read
Supply Chain
What do you do when you hit the five Lambda layer limit?
Lambda allows five layers per function. Options: merge layers, bundle into the package, or move to a container image, with patching tradeoffs for each.
Oct 19, 20263 min read
Supply Chain
Hermetic vs reproducible builds: what is the difference?
Hermetic means isolated from the host machine; reproducible means identical output bits. See how the two relate and which one to work on first.
Oct 19, 20263 min read
Supply Chain
Do header-only C++ libraries show up in an SBOM?
Header-only C++ libraries compile into your code, so no library file ships. Learn why they go missing from inventories and how to record them on purpose.
Oct 19, 20263 min read
Supply Chain
What is the difference between an HBOM and an SBOM?
An SBOM lists the software in a product. An HBOM lists its hardware parts and their firmware. See when an embedded team needs one, the other, or both.
Oct 19, 20263 min read
Supply Chain
Can one bill of materials cover both hardware and software in a device?
Yes, with a format that supports hardware components. Here is what to list for the board, modules, and firmware so fleet questions have one answer.
Oct 19, 20263 min read
Supply Chain
Gradle dependency locking or verification: which do you need?
Locking fixes which versions Gradle resolves. Verification checks the downloaded files are the ones you expected. Different jobs, and CI wants both.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.