Supply Chain
What is dependency confusion and how do you prevent it?
Dependency confusion tricks a build into installing a public package in place of your private one of the same name. See how it works and how to block it.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What is CycloneDX? The bill of materials standard explained
CycloneDX is a modular standard for supply chain information, published as ECMA-424. See what it can describe and how it compares with SPDX.
Oct 18, 20262 min read
Supply Chain
What is an SBOM? A plain definition for engineers and buyers
An SBOM is a formal inventory of the components inside a piece of software. Here is what it contains, who uses it, and what it does not tell you.
Oct 18, 20263 min read
Supply Chain
What is a purl? The Package URL identifier explained
A purl is a standard URL-style identifier for a software package across ecosystems. See its parts, a worked example and why SBOM tools rely on it.
Oct 18, 20263 min read
Supply Chain
What a Gold status means, and what it does not
Gold means no known high or critical vulnerabilities at last scan, plus malware, license and provenance checks. Here is what that leaves unanswered.
Oct 18, 20263 min read
Supply Chain
What goes in an ML-BOM for a model you ship
An ML-BOM records the model, its data, configuration and dependencies. Here is a practical field list drawn from CycloneDX, SPDX 3 and model card metadata.
Oct 18, 20263 min read
Supply Chain
What does a signed SBOM prove, and what does it not?
A signature shows who made an SBOM and that it was not altered, not that the contents are accurate. What the 2026 author signature field adds and lacks.
Oct 18, 20263 min read
Supply Chain
What a model signature does not tell you
A valid model signature shows files match what an identity signed. It does not show the model is safe, unbiased, licensed or free of poisoned data.
Oct 18, 20263 min read
Supply Chain
What a container image signature proves, and what it does not
A valid signature shows who signed an image digest, not that the image is safe. Learn what verification checks and which risks a signature cannot cover.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.