Supply Chain
What is Rekor and what does a transparency log entry prove?
Rekor is Sigstore's append-only transparency log. An entry shows a signing event was recorded and can be audited, not that the signed software is safe.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What are pnpm trustPolicy and minimumReleaseAge, and how do they differ?
minimumReleaseAge waits before installing new versions. trustPolicy no-downgrade refuses a version whose trust evidence got weaker. Two different checks.
Oct 19, 20263 min read
Supply Chain
What is dependency hygiene for a team that uses many languages?
Dependency hygiene for a polyglot team means the same four controls in every language: locked installs, integrity checks, update routine, shared inventory.
Oct 19, 20264 min read
Supply Chain
What is dependency drift between dev, staging, and prod?
Dependency drift is when the packages in dev, staging, and prod no longer match. Here is how it starts, why it matters for security, and how to spot it.
Oct 19, 20263 min read
Supply Chain
What is builder.id in provenance and why does it set your SLSA level?
builder.id names the build platform that produced an artifact, and SLSA says it alone determines the Build level. Learn what to trust and how to pin it.
Oct 19, 20264 min read
Supply Chain
What is build cache poisoning and how do you recover?
Build cache poisoning plants a bad output where later builds will reuse it. Learn how it happens in shared caches, how to spot it and what to clear.
Oct 19, 20264 min read
Supply Chain
What is an SBOM management platform? A plain definition
An SBOM management platform stores, validates, tracks and shares SBOMs across products and releases. Here is what that covers and what it does not.
Oct 19, 20264 min read
Supply Chain
What is an Apache Incubator podling, and can you depend on one?
A podling is a project still in Apache incubation. Incubation says governance is maturing, not that the code is unfinished or unsafe. How to judge one.
Oct 19, 20263 min read
Supply Chain
What is a poisoned update and how is it not a normal vulnerability?
A poisoned update is malicious code shipped as a normal upgrade. A vulnerability is an accidental flaw. The difference changes how you detect and respond.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.