Supply Chain
Local actions or Marketplace actions: which is easier to secure?
A local action lives in your repo and goes through your review. A Marketplace action is someone else's code. Trade-offs, and what Dependabot skips.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you plan a device fleet around Linux longterm kernel end of life?
Check which longterm kernel each device release uses, note the projected end of life on kernel.org, and schedule a move before the support window closes.
Oct 19, 20264 min read
Supply Chain
How do you limit which GitHub Actions your organization can run?
Set an allowlist of actions and reusable workflows, block specific ones with a bang prefix, and require full commit SHA pinning. Steps and wildcard rules.
Oct 19, 20263 min read
Supply Chain
Why does a library scan differ from the apps that use it?
npm does not publish your lockfile, so apps that install your library resolve their own versions. That is why library and app scan results can disagree.
Oct 19, 20264 min read
Supply Chain
How do you pin a kustomize remote base to a ref or full commit?
Kustomize can load bases from a Git URL. Add a ref parameter with a tag or full commit hash so the remote base cannot change underneath your builds.
Oct 19, 20264 min read
Supply Chain
How should you keep SBOM history? Snapshots, edits and retention
Keep each release SBOM as an unchanged snapshot, record corrections as new versions, and tie each one to a build. Here is what history should include.
Oct 19, 20264 min read
Supply Chain
How do I keep SBOMs and scan reports after GitHub artifacts expire?
Workflow artifacts expire after 90 days by default. Set retention-days, copy reports to storage you control, and record the digest. Steps for audit trails.
Oct 19, 20263 min read
Supply Chain
Why should publishing and resolving use separate mirror repositories?
Keep internal packages in a hosted repository, keep public packages in a proxy repository, and expose one read endpoint. Why the split limits damage.
Oct 19, 20264 min read
Supply Chain
How do you keep a forked chip vendor SDK patched?
Most hardware startups fork their chip vendor's SDK. Here is how to track upstream fixes, record your edits and know when your fork is falling behind.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.