Supply Chain
Do npm ci and pip hash checking stop a compromised version?
What npm ci and pip hash checking protect against, and what they cannot do once a compromised version is already in your lockfile or requirements file.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Do GitHub stars and download counts show a library is safe?
Stars and downloads measure attention, not safety. Myth versus fact on popularity signals, and what to check instead before you adopt a library.
Oct 19, 20263 min read
Supply Chain
Do GitHub Actions and CI plugins need dependency intake too?
Yes. Actions run with access to your build and secrets, so they need the same intake as packages. Here is a practical review and pinning policy.
Oct 19, 20263 min read
Supply Chain
Do dev and build dependencies belong in an acquisition inventory?
Yes, but labelled by scope. Dev and build dependencies rarely ship, yet they run on developer machines and in CI, where a compromise can reach the product.
Oct 19, 20263 min read
Supply Chain
Do composite actions pin the actions they call inside?
Not necessarily. A composite action can call other actions by a moving tag, and those run in your job. How to find nested references and handle them.
Oct 19, 20264 min read
Supply Chain
Do CI build and tool images need the same scanning as production images?
Build images never reach customers but hold your tokens and keys. Scan them for different reasons and with different rules than production images.
Oct 19, 20264 min read
Supply Chain
Do archived research repositories need to be scanned again?
Yes, on a lighter schedule. New advisories appear after you archive code. How to store an inventory and recheck it so readers know the status.
Oct 19, 20264 min read
Supply Chain
Why does a container scan show a distro advisory and a library CVE?
A distro package and the library inside it get separate advisory records. The OSV upstream field links them without merging them. Here is how to read both.
Oct 19, 20264 min read
Supply Chain
Distribution package vs import package: why can pip install foo mislead?
A distribution package is what you install, an import package is what you import. PyPI does not tie the two names together, so guessing is risky.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.