Supply Chain
Does build provenance stop a compromised build platform?
Provenance helps detect tampered inputs and impostor builders, but a compromised platform can still sign bad output. Know what it covers and misses.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Does the RTOS belong in a firmware SBOM?
Yes. The RTOS kernel and its bundled libraries are shipped code with their own advisories. Here is how to list them, with versions, in a firmware SBOM.
Oct 19, 20264 min read
Supply Chain
Does a single-file CLI binary still need an SBOM?
Yes. Bundling a CLI into one executable hides its dependencies from manifest scanners. Generate the SBOM at build time and publish it with each release.
Oct 19, 20263 min read
Supply Chain
Does a signed Maven Central artifact mean the library is safe?
A GPG signature and a verified namespace show who published a jar and that it was not altered. They do not show the code is free of flaws. Myth vs fact.
Oct 19, 20264 min read
Supply Chain
Can a scanner see a library you download in a Dockerfile?
Libraries fetched with ADD or curl inside a Dockerfile have no manifest entry, so many scans miss them. Where they show up and how to record them.
Oct 19, 20263 min read
Supply Chain
Does a scan cover a PyInstaller or other frozen Python app?
A frozen Python executable bundles the interpreter and libraries into one file. What a source scan sees, what it misses, and how to inventory the bundle.
Oct 19, 20263 min read
Supply Chain
Does a lockfile in your component library protect the apps using it?
No. A package-lock.json in a published library is not shipped to consumers, so apps resolve your dependency ranges fresh. What to do about it.
Oct 19, 20264 min read
Supply Chain
Does a dependency update tool run code from your project while updating?
Update tools may run package managers that execute manifest code to rewrite lockfiles. See the safeguards and what to check before granting access.
Oct 19, 20264 min read
Supply Chain
Does a cached package need re-verifying before CI reuses it?
Yes, if the cache can be written by others. Compare Go, pip and npm checks that detect a changed package after restore, and where to run them.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.