Supply Chain
Which VEX format should a software vendor publish?
A decision guide to publishing VEX as CSAF, CycloneDX or OpenVEX: what each carries, what customers tend to ask for, and how to avoid maintaining three.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Which tools can find zero-day vulnerabilities in your dependencies?
Advisory scanners cannot find true zero days. Here are the four approaches that can, what each needs from you, and how to judge claims about them.
Oct 18, 20263 min read
Supply Chain
Which tool stops which software supply chain attack class?
A buyer's map of four supply chain attack classes, dependency confusion, hijacked maintainers, build compromise and bad updates, and the control for each.
Oct 18, 20264 min read
Supply Chain
Which SLSA Build level should you target: L1, L2 or L3?
A decision table for choosing SLSA Build L1, L2 or L3 based on who consumes your artifacts and what you can change on your build platform today.
Oct 18, 20264 min read
Supply Chain
Which SBOM do you use when a supplier sends an updated version?
Use serial number, version and timestamp to pick the right revision of a supplier SBOM, keep the old one, and avoid double counting findings.
Oct 18, 20263 min read
Supply Chain
Which SBOM fields can leak internal details before you share it?
A pre-send checklist of SBOM fields that can expose internal package names, registry URLs, file paths and tool details, and how to handle each one.
Oct 18, 20264 min read
Supply Chain
Which package URL type should a C or C++ library use in an SBOM?
Use the purl type that matches where the library came from: conan, vcpkg, deb, rpm, apk, github or generic. A short decision table with the reasoning.
Oct 18, 20263 min read
Supply Chain
Which package managers run dependency code at install time?
A table of which package managers run code from dependencies during install or build, what the documentation says, and what that means for malware risk.
Oct 18, 20263 min read
Supply Chain
Which npm access token settings should a CI publish job use?
Use a granular npm token limited to the packages you publish, with an expiry and IP limits. The settings explained, plus the 2FA bypass trap.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.