Supply Chain
How do you merge two dependency policies after a merger?
Merging two dependency policies means comparing them rule by rule, picking one outcome per rule, and phasing in the change. Here is a practical sequence.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do I measure our shadow dependency rate?
Define shadow dependency rate as the share of packages outside your approved list, count it per repo, and track the trend. Formulas, pitfalls and a target.
Oct 19, 20264 min read
Supply Chain
How do you measure the dependency footprint of your SDK?
Count direct and transitive packages, depth, advisories and update lag for each release, and track change over time. Metrics table, steps and a gate.
Oct 19, 20264 min read
Supply Chain
How do you list internal packages in an SBOM with no public registry?
Internal packages belong in an SBOM. Use a clear identifier, name yourself as supplier, and avoid names a public registry could match by accident.
Oct 19, 20264 min read
Supply Chain
How do you list every WordPress plugin across all client sites?
Use WP-CLI to export plugin name, version, status and update state from each client site into one file, so you can answer which sites run a given plugin.
Oct 19, 20264 min read
Supply Chain
How do you list every Redis, Kafka, RabbitMQ and SQS client you use?
Build an inventory of broker client libraries and server versions from lockfiles, SBOMs and images so an advisory takes minutes to answer, not days.
Oct 19, 20264 min read
Supply Chain
How do you link your SBOM, VEX, and advisories from one page?
Give each product release one place that lists its SBOM, VEX statements, and advisories, so a customer can answer 'are we affected' without emailing you.
Oct 19, 20263 min read
Supply Chain
How do you keep a dependency inventory across every client site?
Keep one record per site listing CMS, plugins, packages, versions, host and owner, refreshed on every release. These are the columns that matter.
Oct 19, 20264 min read
Supply Chain
How do you judge a seller's VEX not affected claims?
A not_affected statement needs a justification label. Check that it names a reason, that the reason fits the code, and that someone can reproduce it.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.