Supply Chain
Build or buy SBOM generation: when open source tooling is enough
When a free open source SBOM generator in CI is enough, and when a platform earns its place: storage, matching, sharing, and who does the work.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Why build once and promote the same artifact through environments?
Build one artifact, record its digest, and promote that exact artifact from test to production. Rebuilding per environment breaks what you tested.
Oct 18, 20263 min read
Supply Chain
How do you bring open source into a network with no internet access?
For networks with no internet, review packages outside, import them as a checked bundle and record what came in. Steps, controls and arrival checks.
Oct 18, 20263 min read
Supply Chain
What is the blast radius if your AppSec vendor is compromised?
A scanner with repo access is a target. How to limit what a compromised vendor could reach: token scopes, repo selection, expiry, rotation and monitoring.
Oct 18, 20263 min read
Supply Chain
How do you attest build provenance for a container image on GitHub?
Add an attestation step after your image build, grant id-token, attestations and packages write, push by digest, then check it with gh attestation verify.
Oct 18, 20263 min read
Supply Chain
How do you attach an SBOM or signature to a container image?
OCI referrers let a registry link an SBOM, signature or attestation to an image digest. What the subject field does and how clients find attachments.
Oct 18, 20263 min read
Supply Chain
How do you attach an SBOM to a container image with cosign?
Attest or sign the SBOM against the image digest. Cosign docs advise a small predicate pointing at the SBOM instead of embedding it. Steps and trade offs.
Oct 18, 20263 min read
Supply Chain
Are .NET global and local tools a supply chain risk?
dotnet tools are NuGet packages that run as programs. Pin versions in a local tool manifest, restore from trusted sources and avoid shared install paths.
Oct 18, 20264 min read
Supply Chain
Are dbt Hub packages safe to install in a production project?
dbt Hub packages are third-party code that runs against your warehouse. Here is what the dbt docs say about trust and how to install them with care.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.