Supply Chain
Vulnerable vs malicious dependency: why you need different checks
A vulnerable dependency has a flaw someone can exploit. A malicious one is built to harm you. They need different detection, triage and response.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Should VEX live inside your advisory or be a standalone document?
CISA says a VEX document does not have to be part of an advisory. Learn when to embed VEX in a CSAF or CycloneDX document and when to publish it alone.
Oct 18, 20263 min read
Supply Chain
VEX status after you upgrade a library: fixed or not affected?
After upgrading a vulnerable dependency, which VEX status do you use? A short guide to fixed versus not affected versus affected for older releases.
Oct 18, 20263 min read
Supply Chain
How to verify Kubernetes control plane images and the release SBOM
Use cosign verify with the krel-trust identity for registry.k8s.io images, and verify the release SBOM with checksums and a signature. Pin digests too.
Oct 18, 20263 min read
Supply Chain
How do you verify a kubectl binary signature with cosign?
Download kubectl with its .sig and .cert files and run cosign verify-blob with the release identity and Google issuer. Steps, flags and what a pass means.
Oct 18, 20263 min read
Supply Chain
How do I verify the Gradle wrapper before I run it?
The Gradle wrapper JAR and distribution run on every developer and CI machine. Pin the distribution checksum and validate the wrapper JAR first.
Oct 18, 20263 min read
Supply Chain
Unrated advisories: severity labels missing by ecosystem
In OSV, 54.5 percent of PyPI advisories and 48.6 percent of Go advisories carry no severity label. Do not read unrated as low; here is how to handle it.
Oct 18, 20264 min read
Supply Chain
How does Unity decide which registry a package comes from?
Unity matches a package name to the closest scope in your scopedRegistries list, else the default registry. How it works and what to check first.
Oct 18, 20263 min read
Supply Chain
Ultralytics PyPI attack: how provenance made it auditable
PyPI's analysis says the first bad releases came through a trusted workflow, the second through a leftover token. What attestations did and did not prove.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.