Supply Chain
PyPI yanked releases: when does pip still install them?
A yanked release is hidden from normal selection but not deleted. See how installers treat exact pins, ranges and lock files, and what to do after a yank.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
PyPI name normalization: why Foo_Bar and foo-bar are the same package
PyPI treats dots, dashes and underscores as one character and ignores case. See the exact rule and what it means for typosquat checks and requirements.
Oct 18, 20263 min read
Supply Chain
Private package namespaces and transitive dependencies in CI scans
Two options on safeguard scan help in pipelines: declare your private namespaces, and resolve transitive dependencies. What each does and what to watch.
Oct 18, 20263 min read
Supply Chain
pip extra-index-url versus uv first-index: which is safer?
pip treats all indexes as equal and picks the best version, which pip's docs call unsafe for private packages. uv defaults to the first index that has it.
Oct 18, 20263 min read
Supply Chain
Pinning Terraform modules: registry version or git ref?
How to pin Terraform module sources so an upstream change cannot slip into your infrastructure: registry versions, git tags and commit SHAs compared.
Oct 18, 20264 min read
Supply Chain
Pin pre-commit hook revisions and update them on purpose
Pre-commit hooks run third party code on every commit. Pin each rev to a tag or SHA, review autoupdate changes, and consider the freeze option for hashes.
Oct 18, 20263 min read
Supply Chain
Pin a Hugging Face model revision to a commit hash
Loading a model by name follows the main branch, so the files can change under you. Pin the revision to a full commit hash and record it in your repo.
Oct 18, 20263 min read
Supply Chain
Package registry outage: how to keep building with a cache or mirror
If the public package registry is down or a package vanishes, builds stop. Plan a cache, a mirror and lockfile discipline so the pipeline keeps moving.
Oct 18, 20264 min read
Supply Chain
Package health grade and OpenSSF Scorecard: how to read them
A Gold health grade can come from OpenSSF Scorecard checks scored 0 to 10. Learn what an A with a zero in one check means and what to do about it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.