Supply Chain
Docker tag or digest: which keeps staging and prod identical?
A digest identifies one exact image, while a tag can move. Deploy by digest to keep staging and production on identical content, and update on purpose.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Docker Content Trust is being retired: what should you use instead?
Docker says Content Trust is being retired and is unreliable for pulls. Unset the flag, then use digest pinning, signature checks and provenance instead.
Oct 19, 20263 min read
Supply Chain
How do I answer "Do you use open source software?" from a customer?
Yes is almost always the true answer. Here is how to reply to a customer's open source question with specifics, a policy pointer and evidence, not a shrug.
Oct 19, 20263 min read
Supply Chain
Do you need the Transparency Exchange API yet?
The Transparency Exchange API aims to standardize how SBOMs and VEX files move between systems. See its data model, its status, and when to wait or adopt.
Oct 19, 20264 min read
Supply Chain
Do you need an SBOM for every container image build?
Generate an SBOM on every build and store it by image digest. Share and retain only released ones. Generation is cheap, retention is the choice.
Oct 19, 20264 min read
Supply Chain
Do you need an NDA before sharing an SBOM with a customer?
Not always. Decide by what the SBOM reveals and who receives it: public summaries need none, detailed SBOMs usually warrant confidentiality terms.
Oct 19, 20264 min read
Supply Chain
Do you need an ML-BOM, or is an SBOM enough for AI-heavy software?
An SBOM covers packages. An ML-BOM adds models, datasets and configuration. Use an SBOM first, add model entries when models ship in your product.
Oct 19, 20263 min read
Supply Chain
Does a small nonprofit with a website or app need an SBOM?
An SBOM is a parts list for your software. A small nonprofit may not need a formal one, but a simple list of dependencies helps. Here is when and how.
Oct 19, 20263 min read
Supply Chain
Do vulnerability alerts cover GitHub Actions pinned to a SHA?
GitHub's Dependabot alerts only cover actions that use semantic versions, not SHA pins. How to keep pinned actions visible to advisories anyway.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.