Supply Chain
How do you pin a Unity Git package so it cannot change under you?
Unity Git dependencies can follow a branch, a tag or a full commit hash. Why a hash is the safest pin, how the lock file helps and what to watch.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What is the difference between PHP active support and security support?
PHP active support fixes bugs and security issues with regular releases; security support covers critical issues only. How to plan around both.
Oct 19, 20264 min read
Supply Chain
npm, pnpm and Yarn supply chain settings: which one controls what?
A table of the documented package manager settings for release age, git dependencies, lockfile checks and install scripts in npm, pnpm and Yarn.
Oct 19, 20264 min read
Supply Chain
Which OWASP CI/CD risks matter most for supply chain attacks?
OWASP lists ten CI/CD risks. See how each maps to a supply chain entry point, and which four a small team should check first, with a one hour review plan.
Oct 19, 20263 min read
Supply Chain
OSPO or security team: who owns which dependency governance task?
An OSPO usually owns open source policy, intake guidance, training and the inventory view. Security owns triage and response. Here is a clear split.
Oct 19, 20264 min read
Supply Chain
OpenVEX or CycloneDX VEX: which should carry your triage decisions?
OpenVEX and CycloneDX VEX can both carry exploitability decisions out of a scanner. Compare their status labels and pick one based on your SBOM format.
Oct 19, 20264 min read
Supply Chain
Which OpenVEX justification fits a firmware vulnerability?
A not_affected VEX statement needs a justification. See the five OpenVEX labels, which fits common firmware cases, and how to back each with evidence.
Oct 19, 20263 min read
Supply Chain
What happens to Open VSX extensions when a publisher revokes?
Revoking an Open VSX publisher agreement deactivates tokens and hides every version. What is reversible, and why republishing a version number is blocked.
Oct 19, 20264 min read
Supply Chain
One scanner flagged a dependency the other missed: what now?
When one dependency scanner reports a vulnerable package and another stays silent, check five things in order before you decide who is right.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.