Supply Chain
What is the hidden work in tracking SBOMs by hand?
Tracking SBOMs by hand hides recurring work: collecting files, reshaping formats, reconciling versions, answering questions and rebuilding audit evidence.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you test a transitive dependency bump you did not ask for?
A transitive bump changes code you never chose. How to find what moved, test the paths that touch it, and decide to accept, pin or override.
Oct 19, 20264 min read
Supply Chain
How do you pin Terraform providers and commit the lock file safely?
Set constraints for what Terraform may install, and commit .terraform.lock.hcl so providers are checked against recorded checksums. Steps and limits.
Oct 19, 20264 min read
Supply Chain
How do you tell customers a dependency issue does not affect you?
A not affected message needs a reason, a date and a scope. Wording, a reason table based on OpenVEX justifications, and mistakes to avoid.
Oct 19, 20264 min read
Supply Chain
How do you tell customers a CVE does not affect your product?
Tell customers a CVE does not affect you with a short VEX style statement: the status, a standard justification, and the version it applies to.
Oct 19, 20263 min read
Supply Chain
Tag, semver range or digest: how to pin across IaC and GitOps tools
A decision guide to pinning Terraform, Helm, Argo CD, Flux, Crossplane and kustomize sources: which reference types each supports and what to choose.
Oct 19, 20265 min read
Supply Chain
Tabletop script: a SaaS vendor emails you about a breach
A 45 minute tabletop script for a vague vendor breach notice: find your integrations, revoke access, question the vendor, decide what to tell customers.
Oct 19, 20264 min read
Supply Chain
Tabletop script: a malicious release of your own package
A 60 minute tabletop script for when your own package's maintainer token is stolen and a bad version is published: stop, warn, rotate and rebuild trust.
Oct 19, 20264 min read
Supply Chain
Tabletop script: a base image in your registry is compromised
A 60 minute tabletop script for a compromised container base image: find every image built from it, pick what to rebuild, prove rebuilds are clean
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.