Supply Chain
Why is scanning after install too late for malicious packages?
Install time scripts can run before any scan does. For malicious packages, the decision has to come before download or install, not after.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you write a verify page so users can check your releases?
Give users the exact commands: key fingerprint, checksum check, signature check and the identity to expect. A signature nobody can verify protects no one.
Oct 19, 20263 min read
Supply Chain
How do you write a supply chain risk appetite statement?
A supply chain risk appetite statement says how much third-party software risk you will accept and where tolerances sit. Here is a plain way to draft one.
Oct 19, 20263 min read
Supply Chain
How do you vet a premium or non-directory WordPress plugin?
Buy from the author, check licence and update history, test on staging, and record where it came from. A vetting routine for plugins outside WordPress.org.
Oct 19, 20263 min read
Supply Chain
How do you vet an open source maintainer before adopting a package?
Vet a maintainer in 30 minutes with a rubric: activity, account hygiene, release practice, vulnerability handling and continuity. Includes a scoring table.
Oct 19, 20264 min read
Supply Chain
How do you vet a community Backstage plugin before installing it?
Backstage plugins are packages that run in your own app and backend. Check source, maintainers, dependencies, token needs and permission support first.
Oct 19, 20264 min read
Supply Chain
How do you version a shared Terraform module with semver?
Tag shared Terraform modules with semantic versions and treat input, output and address changes as breaking. Steps, constraint operators and a bump table.
Oct 19, 20264 min read
Supply Chain
How do you verify the integrity of open source packages you install?
Integrity checks, signatures and build provenance answer different questions. Learn what each proves and how to describe your approach to customers.
Oct 19, 20263 min read
Supply Chain
How do you verify an Apache Airflow download before installing?
Verify an Airflow source release with the KEYS file, a GPG signature check and a SHA512 checksum, and know what the trust warning means before you deploy.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.