Supply Chain
Does a dependency cooldown delay security fixes?
A cooldown holds back brand new releases, not security fixes. Here is how common update bots treat the two, and how to keep your exposure window short.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What to check when an outsider's pull request changes dependencies
When a fork pull request edits a manifest or lockfile, check new packages, versions, known vulnerabilities and install scripts before you approve.
Oct 19, 20263 min read
Supply Chain
What is a dependency audit checklist for Rails and Laravel teams?
A practical dependency audit checklist for Rails and Laravel: lockfiles, advisory checks in CI, ignore records, nightly runs, and reachability triage.
Oct 19, 20263 min read
Supply Chain
What access model should an SCA tool have for many business units?
Large organizations need scoped SCA roles: central admins, unit admins, team members and auditors. A checklist for testing delegation before you buy.
Oct 19, 20264 min read
Supply Chain
Declared, built, running: what is the three way inventory check?
Compare what repositories declare, what builds produce and what production runs. Differences between the three show where an inventory cannot be trusted.
Oct 19, 20263 min read
Supply Chain
Does declaring dependencies explicitly help with vulnerability scanning?
Yes. Twelve-factor's explicit dependency manifest and isolation lets a scanner see exactly what you ship. Here is how to make that true in practice.
Oct 19, 20264 min read
Supply Chain
Debian 12 bookworm base images: what changed after July 2026?
Debian lists bookworm as oldstable with regular support ended on 11 July 2026 and LTS to June 2028. What that means for images that start FROM bookworm.
Oct 19, 20264 min read
Supply Chain
CycloneDX or SPDX: which SBOM format should an agency give a client?
Both CycloneDX and SPDX are open SBOM formats. Pick the one your client's tools read, and generate it from the real build, dated and ready to convert.
Oct 19, 20263 min read
Supply Chain
Which CycloneDX component types fit firmware and devices?
CycloneDX 1.6 has device, firmware, operating-system and device-driver types. Here is when to use each in an embedded product SBOM, with a worked mapping.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.