Supply Chain
Does an SBOM prevent a software supply chain attack?
No. A software bill of materials does not prevent attacks, but it is how you find out fast whether a reported component is in your software.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Does a Sigstore signature expire when its certificate does?
No. Keyless certificates are short lived by design, and a log entry or timestamp proves signing happened while valid. How old signatures stay verifiable.
Oct 18, 20263 min read
Supply Chain
Does a Lambda cold start patch a vulnerable dependency?
A cold start loads the same code and packages as before and does not update your dependencies. Here is what Lambda patches and what you must redeploy.
Oct 18, 20264 min read
Supply Chain
Does a dependency scan cover scripts loaded from a CDN?
A script tag pointing at a CDN never appears in package.json, so most dependency scans skip it. Learn how to inventory it and add integrity checks.
Oct 18, 20263 min read
Supply Chain
How do you add an SBOM and provenance to a Docker build?
BuildKit can attach an SBOM and provenance attestation to the image at build time. Here are the flags, defaults, and what to check before you rely on them.
Oct 18, 20263 min read
Supply Chain
A buyer asks about SLSA provenance. What should a startup say?
What SLSA build levels L1 to L3 mean, how to state your level honestly in a security review, and what to say if you have no provenance yet today.
Oct 18, 20264 min read
Supply Chain
Do you owe a customer VEX for every CVE their scan reports?
No standard requires VEX for every finding. CISA says VEX may be incomplete and sets no default status. Here is how to rank which CVEs get one.
Oct 18, 20263 min read
Supply Chain
Do you need an in-toto layout, or is SLSA provenance enough?
An in-toto layout defines every required step and who may run it. SLSA provenance records one build. When each one fits, and what a layout adds.
Oct 18, 20263 min read
Supply Chain
Do you need an AI BOM entry for a model you only call through an API?
Yes, a lighter one. Record the provider, model name, pinned version, data terms and callers. What to capture when you cannot inspect the weights.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.