Supply Chain Security
Write Your First OpenVEX Statement With vexctl
What a VEX statement says, the four status values, and the five justifications, shown by generating a real OpenVEX document with vexctl v0.4.4.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain Security
Generate a CycloneDX or SPDX SBOM With npm sbom, Then Scan It
npm has a built-in sbom command. We ran it on a 23 package project in both formats, inspected the output, and fed it to a scanner. Commands and real results.
Oct 18, 20265 min read
Supply Chain Security
A customer asked for your SBOM: what to send and what to say
Enterprise buyers now put SBOM requests in questionnaires. Use CISA's 2025 draft minimum elements as the checklist, and send something accurate rather than something big.
Oct 18, 20266 min read
Supply Chain Security
Cosign verify-blob bypass with legacy bundles: check your CI scripts
Cosign v3.1.3 and v2.6.5 fix a High advisory where identity pinning is skipped for legacy JSON bundles. Image verification is not affected, but blob checks may be.
Oct 18, 20265 min read
Supply Chain Security
What to leave out of an SBOM, and how to redact without lying
CISA's 2025 draft says what an SBOM must cover and what it need not. Use it to decide what stays out of the file you send a customer, and how to mark the gaps honestly.
Oct 18, 20264 min read
Supply Chain Security
Source SBOM vs container SBOM: a 71 versus 497 component comparison
We generated both SBOMs for one tiny Node app with Syft and compared them. The numbers show why a customer who asks for an SBOM needs to know which one you mean.
Oct 18, 20265 min read
Supply Chain Security
VEX in practice: one document, four statuses, and when to update it
A working routine for small teams that answer customer vulnerability questions with OpenVEX, using the v0.2.0 spec and vexctl v0.4.4 from June 2026.
Oct 18, 20265 min read
Supply Chain Security
Publish a release verification page: attestations, SLSA v1.2, one command
SLSA v1.2 landed on 24 November 2025. Here is what a small team can publish with every release so a customer can verify who built it and from what, using GitHub attestations and npm trusted publishing.
Oct 18, 20264 min read
Supply Chain Security
A software bill of materials for a robot: what to list and why
A robot ships firmware, an OS image, ROS packages, drivers and ML models. Here is what belongs in its SBOM, using CISA's 2025 minimum elements and the EU rules that now ask for it.
Oct 18, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.