Supply Chain
Does your private npm registry support registry signatures?
npm audit signatures works with any registry serving signing keys at /-/npm/v1/keys and signatures in package metadata. How to check yours and fix gaps.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Does your dependency scanner read lockfiles? A PoC test
Test whether a scanner reads lockfiles or only manifests: why exact versions matter, a five step PoC check, and what to do when versions are guessed.
Oct 19, 20264 min read
Supply Chain
Does two person review stop a malicious commit?
Two person review stops a rogue commit from one account, but not a colluding pair, a build compromise or a missed diff. See what it covers and misses.
Oct 19, 20263 min read
Supply Chain
Does a verified creator badge make a GitHub Action safe?
No. The Marketplace verified creator badge confirms who published an action, not that its code is safe. Here is what it means and what to check.
Oct 19, 20264 min read
Supply Chain
Does the package's repository link match the source you expect?
A quick identity check for any new dependency: confirm the repository link, owner, fork status and build source line up before you install.
Oct 19, 20264 min read
Supply Chain
Is it safe to take the latest Django patch release?
Django says upgrading to the latest patch release is always the right answer. What its policy promises, and what mainstream versus extended support cover.
Oct 19, 20264 min read
Supply Chain
Does suppressing a vulnerability finding change your SBOM?
No. Suppressing a finding hides a vulnerability alert, not the component. The SBOM still lists the package. Share the decision through VEX instead.
Oct 19, 20263 min read
Supply Chain
Does a store approval last? Why extensions need monitoring after review
Stores re-review published items and can act later, so approval is not permanent. A short routine for tracking approved extensions and plugins over time.
Oct 19, 20264 min read
Supply Chain
Does Spack sign its binary packages, and which key should you trust?
Spack CI signs package metadata with GPG keys in two classes. Only the public facing Reputational Key should be used to verify package integrity.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.