Supply Chain
How to verify a third-party model file before you load it
A model download is code and data from a stranger. Checks to run first: source, hash, signature, file format, sandbox, inventory and your own evaluation.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Verified CRX Uploads: protecting an extension if your account is hijacked
Verified CRX Uploads makes the Chrome Web Store require updates signed with your own key. How it works, how to store the key, and what it cannot fix.
Oct 18, 20263 min read
Supply Chain
Third party and vendor risk in acquisition due diligence
A target's vendors become yours at close. What to ask about subprocessors, concentration, contracts and offboarding before you sign the deal.
Oct 18, 20263 min read
Supply Chain
How to validate SPDX and CycloneDX SBOM files from the command line
Check an SBOM is well formed before you ship it. The Safeguard CLI validate command covers CycloneDX, SPDX and VEX, with strict and fail fast modes.
Oct 18, 20263 min read
Supply Chain
How to validate an SBOM before you accept it
Check that an SBOM parses, uses a current format version, has the NTIA fields filled, and matches the software you run. Five checks, about fifteen minutes.
Oct 18, 20263 min read
Supply Chain
Validate and scan an SBOM in CI: SPDX and CycloneDX with the CLI
Use the Safeguard CLI to validate an SBOM against SPDX or CycloneDX, then scan it for vulnerabilities, as two pipeline steps that fail on a bad document.
Oct 18, 20263 min read
Supply Chain
Using OpenSSF Scorecard in a dependency approval process
A decision guide for adding Scorecard to dependency review: which checks to require, when to allow exceptions, and what else to look at beyond the score.
Oct 18, 20263 min read
Supply Chain
The US connected vehicle rule: what software teams should know
The Commerce Department rule on connected vehicles restricts certain China and Russia linked software and hardware from model year 2027. What it covers.
Oct 18, 20263 min read
Supply Chain
Upstream, vendor or managed: where to get patched open source
A decision guide comparing three sources of patched open source packages: straight from upstream, from your OS vendor, or from a curated provider.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.