Supply Chain
Do devDependencies matter for supply chain security?
Dev dependencies may not ship, but they run on developer laptops and CI with real credentials. Learn why they matter and how to triage their findings.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How to put software dependency risk into a risk register
Do not paste scanner output into your register. Group findings into a few scenarios, rate them using reachability, and name an owner for each.
Oct 18, 20263 min read
Supply Chain
Dependency update lag: a simple exposure metric for library risk
Measure how far your dependencies trail the latest release. Update lag predicts how painful the next urgent fix will be, and it is easy to compute.
Oct 18, 20263 min read
Supply Chain
A dependency changed its license to source available: what now?
When a package you depend on moves to SSPL or BSL, a decision guide: check which versions are affected, what your use is, then pin, pay, fork or replace.
Oct 18, 20263 min read
Supply Chain
A one page dependency policy a small engineering team can adopt
A short, practical dependency policy covering what may be added, how updates land, who approves exceptions and how fast fixes ship. Copy and adapt it.
Oct 18, 20263 min read
Supply Chain
A maintainer of a package you use was compromised: first-day checklist
News says a maintainer account behind one of your dependencies was taken over. This checklist covers what to check, freeze and rotate in the first day.
Oct 18, 20264 min read
Supply Chain
Myth vs fact: deleting a file in a later layer removes it from the image
Deleting a file in a later Dockerfile step hides it in the final filesystem but not in the earlier layer. Here is how it works and what to do.
Oct 18, 20263 min read
Supply Chain
CycloneDX or SPDX: which SBOM format should you choose?
Both formats meet the NTIA minimum elements. Choose by consumer demand, license versus security focus, and tooling, and keep the option to export both.
Oct 18, 20263 min read
Supply Chain
CycloneDX vs SPDX: which SBOM format should you pick?
CycloneDX and SPDX are both accepted SBOM standards. Here is how they differ in origin, formats and focus, and a simple rule for choosing one or both.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.