Supply Chain
A base image update flooded my SBOM diff: how do I read it?
A base image change lists dozens of OS packages at once in an SBOM diff. Group the changes, check the digest, and review only what actually matters.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Does an AWS Glue job install the same Python packages every run?
With the additional Python modules parameter alone, Glue resolves packages from PyPI on every run, so a new release can change the job. Here is the fix.
Oct 19, 20264 min read
Supply Chain
How do you prove every dependency came through the approved path?
S2C2F separates audit from enforce. Audit shows whether builds used approved sources. Enforce makes builds fail when they do not. Here is how to do both.
Oct 19, 20264 min read
Supply Chain
How do I attach an SBOM and build attestation to a GitHub release?
Generate an SBOM, attest it in your release workflow with GitHub artifact attestations, and show users how to verify it with gh. Steps and permissions.
Oct 19, 20264 min read
Supply Chain
Are art pipeline tools part of your software supply chain?
Content tools, add-ons and the Git LFS client touch every asset you ship. Why creative studios should inventory them, and what to record for each.
Oct 19, 20264 min read
Supply Chain
Are unsigned releases a reason not to adopt an open source package?
Unsigned releases weaken your ability to verify what you install, but they are not an automatic reject. What to check instead and how to compensate.
Oct 19, 20263 min read
Supply Chain
Are your Python build requirements pinned? Build isolation explained
Pip builds sdists in an isolated environment with fresh build requirements. Learn why a pinned file does not cover them and how to constrain them.
Oct 19, 20264 min read
Supply Chain
Are marketplace templates and components safe to import into low-code apps?
Marketplace templates can carry hidden scripts or flaws that spread across apps. How to vet them and build a small internal library instead.
Oct 19, 20263 min read
Supply Chain
Are Kubernetes manifests part of your software supply chain?
Yes. Manifests and Helm values decide which images run and with what access, so they are supply chain inputs that need ownership, review and provenance.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.