Supply Chain
SBOM vs vulnerability report vs VEX: which one answers what?
An SBOM lists what is inside, a scan report lists known flaws, and a VEX says which flaws matter. Learn which document answers which question.
Oct 19, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What does NOASSERTION mean in an SBOM, and is it a problem?
NOASSERTION in an SBOM means the author is not claiming a value. Learn how it differs from NONE, when it is fine, when it is a red flag, and how to fix it.
Oct 19, 20267 min read
Supply Chain
The news names a package. Is it the npm one or the PyPI one?
Different registries can hold different packages with the same name. Confirm the ecosystem, publisher and version before you act on a package in the news.
Oct 19, 20266 min read
Supply Chain
What is a package URL (purl) in an SBOM and why does it matter?
A package URL, or purl, is a standard label for a software package. See how to read one, why names alone cause mismatches, and how it helps SBOM matching.
Oct 19, 20267 min read
Supply Chain
How long does a supply chain security platform rollout take?
Rollout time depends on repos and teams, not the tool. A phased plan for a supply chain platform, from first scan to enforced gates, with exit criteria.
Oct 19, 20266 min read
Supply Chain
Which VEX justification fits a container finding that does not apply?
OpenVEX has five fixed not_affected justifications. Here is how to pick the right one for a container finding and what evidence each one needs.
Oct 19, 20267 min read
Supply Chain
Why does my SBOM list so many packages? Direct vs transitive
Why an SBOM lists far more packages than you installed: direct and transitive dependencies explained, with a worked example and where to focus.
Oct 19, 20268 min read
Supply Chain
Is reachability analysis the same as SAST?
No. SAST looks for flaws in code you wrote. Reachability analysis checks whether vulnerable code in a dependency is actually called. They share methods.
Oct 19, 20267 min read
Supply Chain
Why do two SCA tools report different dependency counts?
Two SCA tools can scan one repo and list different numbers of dependencies. Scope, dev packages, lockfiles, and deduplication explain most gaps.
Oct 19, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.