Supply Chain
How do I make one SBOM for a multi-module Maven build?
Use the CycloneDX Maven plugin's makeAggregateBom goal for a root SBOM across modules, and learn the defaults for scope, schema version and output files.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
A customer scanned your SBOM and found CVEs. How do you reply?
How to answer a customer who scanned your SBOM: sort the findings, reply per status, send VEX for the ones that do not apply, and agree an update cadence.
Oct 18, 20263 min read
Supply Chain
A customer ran a scan on your SBOM. How do you reply to the findings?
When a customer sends scanner findings on your SBOM, triage them, answer with VEX statuses, and reply with specific, dated answers, not a blanket denial.
Oct 18, 20263 min read
Supply Chain
CSRB Log4j review: the organizations that coped knew their inventory
The Cyber Safety Review Board found the best Log4j responders already knew where it ran. What inventory and vulnerability response the Board recommends.
Oct 18, 20263 min read
Supply Chain
What the CSRB recommends for open source security and SBOMs
From the Log4j report: recommendations on secure development, SBOM tooling, funding open source and software transparency for government vendors.
Oct 18, 20263 min read
Supply Chain
Outsourcers as an entry point: third-party lessons from the CSRB
The Cyber Safety Review Board found attackers targeted outsourcers and bought stolen logins. Steps to bring vendors into your security program.
Oct 18, 20263 min read
Supply Chain
CSAF and TLP labels: which advisories can you make public?
How CSAF 2.0 treats TLP labels: TLP:WHITE must be freely accessible, TLP:AMBER and TLP:RED must be access protected. A short guide for vendors.
Oct 18, 20263 min read
Supply Chain
CSAF roles explained: publisher, provider and trusted provider
What the CSAF 2.0 publisher, provider and trusted provider roles each require, in a table, and which one a software vendor should aim for first.
Oct 18, 20263 min read
Supply Chain
CSAF directory layout or ROLIE feed: which should you use?
CSAF 2.0 lets a provider distribute through year folders with index.txt and changes.csv, or through a ROLIE feed. Compare the two and pick one.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.