Supply Chain
Reproducible builds or SLSA provenance: which comes first?
Reproducible builds let anyone verify an artifact by rebuilding. SLSA provenance records how it was built. Different questions, so pick an order.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you report a wrong affected version range in an advisory?
If an advisory lists the wrong affected versions, suppress narrowly, gather proof and report it to the database so the false positive stops for everyone.
Oct 19, 20263 min read
Supply Chain
Who can publish your packages and images? A registry access review
If your startup publishes packages, SDKs or container images, buyers will ask who can push them. A short access review checklist and evidence to keep.
Oct 19, 20264 min read
Supply Chain
What should happen when a registry proxy blocks a package?
Design the exception path before you turn blocking on: clear messages, a named approver, a time limit and a record, so developers do not bypass the proxy.
Oct 19, 20263 min read
Supply Chain
How do you reconcile different dependency versions when merging repos?
Merged repos often use different versions of one package. Inventory them, pick a patched target, upgrade in small steps, and keep local links explicit.
Oct 19, 20264 min read
Supply Chain
How do you read the diff between two package versions?
Compare the old and new package contents with npm diff or a repository compare view before merging a fix. What to look at first and what to flag.
Oct 19, 20264 min read
Supply Chain
What questions must your open source inventory answer in an incident?
An inventory earns its keep when a package is compromised. It should say where it runs, who owns the service and which release shipped it and who to call.
Oct 19, 20264 min read
Supply Chain
What should you ask a supplier after you have read their SBOM?
After reading a supplier SBOM, send five targeted follow-ups: scope, depth, fixes, exploitability, and update cadence. A reusable reply you can adapt.
Oct 19, 20264 min read
Supply Chain
What should you ask a data or labeling vendor before you train?
Fifteen questions for suppliers of training data and labeling: provenance, rights, access, quality and change notice, with what good answers look like.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.