Supply Chain
Why does an image scan of a scratch image show no packages?
A scan of a scratch based image often lists nothing because there is no package database to read. What that means and how to still get an inventory.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Why can two SBOMs for the same container image differ?
Two SBOMs of one image can differ because of scan scope, tool, format and timing. A short list of causes and how to compare them without panic.
Oct 19, 20263 min read
Supply Chain
Why does one scanner show a fixed version and another show none?
A blank fix column can mean no fix exists, a record that lacks the field, a malware package or a different release line. Here is how to tell which one.
Oct 19, 20263 min read
Supply Chain
A shared library's own dependency is vulnerable: whose problem is it?
When a transitive dependency of your shared library has an advisory, the library owner triages it first, then consumers upgrade. Roles and steps explained.
Oct 19, 20263 min read
Supply Chain
Who writes the advisories an open source scanner relies on?
A scanner is only as good as its advisory data. See who authors those records, how they are curated and what to ask about before you trust the output.
Oct 19, 20264 min read
Supply Chain
Who vets the third-party scripts on a client website?
Analytics, chat and tag scripts run with full page access. Assign an owner, keep a list, and pin versions with Subresource Integrity where files do not change.
Oct 19, 20263 min read
Supply Chain
Who vets the Python packages used in Snowflake UDFs?
Snowflake says it does not check or curate the security of Python packages from external sources. What that leaves for your data team to review.
Oct 19, 20263 min read
Supply Chain
Who updates the SRI hash when a vendor ships a new script?
A Subresource Integrity hash breaks the moment a vendor changes a file. Here is who should own the update, the review steps and a safe release routine.
Oct 19, 20264 min read
Supply Chain
Who should be allowed to write to a Bazel remote cache?
Let only trusted CI write to a shared Bazel remote cache and make developers read only. Here is the flag, the reasoning and a simple rollout plan.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.