Supply Chain
License fields to require in a supplier SBOM
A checklist of license data to ask for in a supplier SBOM: identifiers, declared and concluded values, expressions, unknowns and how to check them.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
left-pad: what npm changed after one developer unpublished 273 packages
In March 2016 an unpublish broke thousands of builds for about 2.5 hours. npm's own account of what happened and the policy changes that followed.
Oct 18, 20263 min read
Supply Chain
Left-pad in 2016: what 11 lines taught the npm ecosystem
On 22 March 2016 an unpublished npm package broke builds for thousands of projects. Here is what happened and the policy that came out of it.
Oct 18, 20263 min read
Supply Chain
Lambda code signing: what it stops and what it does not
Lambda code signing checks that deployments come from a trusted signer. It will not catch a vulnerable dependency or code that was signed by mistake.
Oct 18, 20263 min read
Supply Chain
Is there an npm package for the Safeguard MCP server? No, and why
Safeguard hosts its MCP server and publishes no npm package or local bridge. Treat any package that claims otherwise as untrusted. Myths and facts here.
Oct 18, 20263 min read
Supply Chain
Hugging Face verified commits: what the badge proves about a model
A Verified badge on a Hub commit shows the commit was signed with a key registered to an account. It proves origin, not that the model file is safe.
Oct 18, 20263 min read
Supply Chain
How to scope a vehicle software recall with an SBOM
When a flaw lands in a shared component, which products are affected? How per-release SBOMs turn guesswork into a search, using the Jeep recall as a case.
Oct 18, 20264 min read
Supply Chain
How to read a VEX document you received: a consumer checklist
A step by step checklist for reading a supplier's VEX file: who wrote it, what products it covers, which statuses it uses, and what to do with each statement.
Oct 18, 20263 min read
Supply Chain
How to mark an unknown supplier or version in an SBOM
Do not guess a component's producer or version. Mark it unknown, in the way your format supports. SPDX NOASSERTION, CycloneDX gaps, and the 2026 guidance.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.