Supply Chain
Security questions to ask suppliers of vehicle and robot components
A buyer's list of questions for suppliers of connected components: SBOM, support period, update path, disclosure process and provenance of code.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
The provenance item on a package page: what it tells you
Provenance asks whether a package traces back to its source. Learn how to read the sentence under that checklist item and verify it yourself.
Oct 18, 20263 min read
Supply Chain
SolarWinds: why a validly signed update still carried a backdoor
The SolarWinds Orion backdoor shipped inside a signed update. What CISA says happened, what a signature proves, and what build integrity adds.
Oct 18, 20263 min read
Supply Chain
SolarWinds 2020: the build compromise timeline in plain words
A dated walk through the SolarWinds Orion compromise, from the first test change in 2019 to discovery in December 2020, and the numbers to treat with care.
Oct 18, 20263 min read
Supply Chain
A timeline of software supply chain incidents, 2014 to 2024
A dated list of well-known supply chain events from Heartbleed in 2014 to the XZ backdoor in 2024, with the one lesson each one is usually used to teach.
Oct 18, 20263 min read
Supply Chain
What is SLSA? Supply chain levels for software artifacts
SLSA is a set of incremental guidelines for supply chain security, with Build Track levels 1 to 3. Learn what each level is for and how to start.
Oct 18, 20263 min read
Supply Chain
The six SBOM types: design, source, build, analyzed, deployed, runtime
CISA's community document names six SBOM types: design, source, build, analyzed, deployed and runtime. What each captures and where each one is blind.
Oct 18, 20263 min read
Supply Chain
Sigstore keyless signing: what a verifier must actually check
A keyless signature only means something if you verify the signer's identity. Here is what Cosign, Fulcio and Rekor each contribute and what to enforce.
Oct 18, 20263 min read
Supply Chain
Signature, provenance and SBOM attestation: what each one tells you
Signatures show who signed, provenance shows how it was built, an SBOM shows what is inside. Here is what each answers and how they fit together.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.