Supply Chain
A malware advisory has no fixed version: what do you do?
Malicious package advisories list no fix because there is nothing to upgrade to. Here are the steps to take: remove, search, and rotate credentials.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Malicious or just vulnerable: the first branch in a dependency runbook
How to tell a malicious dependency from a vulnerable one, and why the answer changes your first hour: containment, credentials and what reachability shows.
Oct 19, 20264 min read
Supply Chain
Maintainers versus publishers: who can ship a release of your dependency?
The people who write code and the identities that can publish are different sets. Why that gap matters when you assess a dependency, and how trusted publishing narrows it.
Oct 19, 20264 min read
Supply Chain
How do you tell if an open source dependency is abandoned?
Signals of an abandoned dependency: archived repository, no commits for months, unanswered issues. Here is a way to check and what to tell a buyer.
Oct 19, 20263 min read
Supply Chain
What is an SBOM of the runtime production environment under M-26-05?
A footnote in OMB M-26-05 says cloud platform SBOM terms should cover the runtime production environment. What that means and how a SaaS team can prepare.
Oct 19, 20264 min read
Supply Chain
How do you lock down installs for an AI-built Python prototype?
Lock a Python prototype's installs with pinned versions, hash checking and binary-only installs. What each pip option does and when it is worth the effort.
Oct 19, 20264 min read
Supply Chain
What is lockfile poisoning and which package manager settings catch it?
Lockfile poisoning slips a changed resolved URL or version into a pull request. What it is, and what pnpm trustLockfile and Yarn hardened mode do about it.
Oct 19, 20264 min read
Supply Chain
How do you lock the actions in a copied workflow with a lockfile?
GitHub's workflow dependency lockfile, in public preview, records the exact commit of every action. Steps to generate, review and keep it current.
Oct 19, 20264 min read
Supply Chain
How do you stop users adding conda channels on a shared server?
An administrator condarc with the final flag, plus allowlist and denylist channel settings, lets a shared conda install restrict where packages come from.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.