Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Generate SBOM, SaaSBOM, OBOM, CBOM, HBOM and AIBOM files with cdxgen, CycloneDX CLI, SPDX tools and vexctl, then merge, validate and run them in CI.
SPDX 3.0 profiles beyond Software: what Build, Security, SimpleLicensing, ExpandedLicensing, Lite and Extension record, field by field, with valid JSON.
An OBOM is a CycloneDX inventory of what is running on a host, VM or container: OS, packages, services and configuration. Here is how to build and use one.
SWID tags (ISO/IEC 19770-2) identify installed software in XML; CoSWID (RFC 9393) is the compact CBOR form. Fields, uses, conversion and when to accept.
xBOM is shorthand for the whole bill of materials family: SBOM, SaaSBOM, HBOM, OBOM, MBOM, AIBOM, CBOM and more. What each records and when you need it.
A SaaSBOM is a CycloneDX BOM whose services list endpoints, auth, trust zones and data flows. Draft it with cdxgen, finish by hand, link and validate it.
Researchers found 25 flaws in the x402 agent payment SDK, three critical. Affected and fixed @x402 versions, npm checks and spend limits, in one place.
Genesys says an intruder took business contact data from its internal CRM and LMS, not Genesys Cloud. What is confirmed and how to block the phishing.
Three Archibus flaws chain into unauthenticated code execution on 2025.01 and older. Apply Eptura's hotfix or move to 2025.02; no exploitation reported.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
