Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
BOM-Link is a CycloneDX URN that points at another BOM, or one element in it, by serial number and version. Here is how to link one release's BOM set.
CycloneDX grew from an XML parts list in 2018 to 1.7 in 2025. What each version added, how ECMA-424 maps to 1.6 and 1.7, and which version to emit.
CDXA records claims and evidence against a standard; in-toto and SLSA describe how an artifact was built; a Sigstore bundle proves who signed it.
A VDR lists every vulnerability affecting a product with its impact analysis. A BOV shares vulnerability data alone. Fields, JSON examples and when to ask.
SPDX 3.0 writes VEX as four typed relationships from a vulnerability to products. How that compares with CSAF 2.0, OpenVEX and CycloneDX, field by field.
A KBOM is a Kubernetes bill of materials: control plane, nodes, add-ons, CRDs, Helm releases and images by digest. Here is how to build one in CycloneDX.
Use the OWASP AIBOM Generator for Hugging Face models and cdxgen for repositories, then fill the human fields, validate, sign and store the AIBOM in CI.
The Riemann hypothesis says every non-trivial zeta zero has real part 1/2. It is unproved, and a proof would not break RSA or elliptic curve crypto.
SBOM quality scores do not carry over to other BOM types. Validate the schema, then check identity, links, completeness and type fields for each BOM.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
