Supply Chain
Why does cosign verify need a certificate identity and issuer?
A keyless signature only proves some identity signed the file. Cosign 2.0 requires identity and issuer flags so you trust the publisher you intend.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Who inside your company should be able to see supplier SBOMs?
Supplier SBOMs are often shared in confidence. Set role based access, logging and sharing rules so the files help security without leaking supplier detail.
Oct 18, 20263 min read
Supply Chain
Who reports malicious npm packages in OSV? Counts by source
Four report sources cover 80% of 222,536 npm malware records in OSV, and 20% name none. What that says about gaps in detection coverage and trust.
Oct 18, 20264 min read
Supply Chain
Who inside a software vendor should own SBOM and VEX requests?
A role split for SBOM and VEX work: product security owns facts, engineering owns generation, legal owns terms, and sales owns the customer conversation.
Oct 18, 20263 min read
Supply Chain
Who owns a CVE in a library bundled inside a vendor SDK?
If you ship a chip vendor SDK with an old library inside, you own the risk in your product. How to find bundled libraries, ask the vendor and record it.
Oct 18, 20264 min read
Supply Chain
Who fixes a vulnerable internal shared library, and who upgrades?
When an internal library is vulnerable, its owner ships the fix and each consuming team upgrades. How to split the work, release, and track adoption.
Oct 18, 20263 min read
Supply Chain
Who are you trusting when you verify SLSA provenance?
Verified provenance still rests on trust: the build platform, your roots of trust and your expectations. A map of what you rely on and how it can fail.
Oct 18, 20264 min read
Supply Chain
Who can publish your package? Owner roles on npm, PyPI and crates.io
Compare what package owners and maintainers can do on npm, PyPI and crates.io, and how to review and trim the list of people who can ship your releases.
Oct 18, 20263 min read
Supply Chain
Which vulnerability databases should SBOM matching use?
No single database covers every component. Compare ecosystem advisories, aggregated open source data, CVE records and exploitation lists, and layer them.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.