Supply Chain Security
Safeguard SBOM Studio: author, sign and publish SBOMs
SBOM Studio exports CycloneDX and SPDX from one component graph, signs them and carries VEX statements. What the page says, and what it does not.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain Security
Safeguard Secure Libraries: a signed mirror with patched dependencies
Rebuilt open source libraries served through a registry mirror, with signatures that fail closed. What the page lists and what its guarantees depend on.
Oct 18, 20262 min read
Supply Chain Security
Safeguard TPRM: vendor SBOMs, intake and scheduled rescans
Third Party Risk Manager collects vendor SBOMs, checks signatures and rescans them on a schedule you define. What the page lists, and what it leaves out.
Oct 18, 20262 min read
Supply Chain Security
Safeguard Open Source Manager: an install gate for dependencies
OSM is a curated registry, mirror and policy gate for open source use. Licenses, maintainer health, typosquats and the audit log it lists.
Oct 18, 20262 min read
Supply Chain Security
Safeguard ESSCM: the seven step supply chain workflow
Enterprise Software Supply Chain Manager connects source control, scans, reachability, policy, fix pull requests and an audit log. The steps as the page lists them.
Oct 18, 20262 min read
Supply Chain Security
Safeguard Marketplace: connectors, SBOM bundles and Gold components
The marketplace page lists Gold components in early access, connectors, verified SBOM bundles and compliance packs. What each is, and the install flow it describes.
Oct 18, 20262 min read
Supply Chain Security
Harbor's October 2026 Fixes: Robot Accounts That Become Admins
Harbor 2.15.3, 2.14.5 and 2.13.6 fix robot privilege escalation, webhook SSRF and a User-Agent bypass of pull policies. What to check and change.
Oct 18, 20266 min read
Supply Chain Security
GhostAction Returns: Fake 'Security Audit' Workflows Steal CI Secrets
Hijacked GitHub accounts pushed a workflow posing as a security audit to tens of thousands of repositories in October 2026. It scans code and git history for keys and posts them over plain HTTP.
Oct 18, 20266 min read
Supply Chain Security
npm Trusted Publishing Now Expires Unused Configs After 48 Hours
npm matched never-used trusted publishing configs by repository name, so a reclaimed repo name could publish your package. Unvalidated configs now expire after 48 hours.
Oct 18, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.