Supply Chain
Can Kubernetes admission control require an SBOM attestation?
Built-in CEL policies cannot fetch an attestation from a registry. A webhook can. How to enforce SBOM presence at admission and what to check first.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Can pull requests from outside developers reach your CI secrets?
Privileged triggers like pull_request_target can hand secrets to untrusted code. See the risky pattern, a safe split and a checklist for your workflows.
Oct 19, 20264 min read
Supply Chain
Can a fork pull request poison your GitHub Actions cache?
Cache poisoning plants files a later privileged job restores. How GitHub scopes caches for pull requests and what maintainers should do about it.
Oct 19, 20263 min read
Supply Chain
Can dependency scanning work offline or in an air-gapped network?
Yes, if the scanner can use a local copy of the vulnerability database. Here is how offline scanning works, what you give up, and how to keep data fresh.
Oct 19, 20264 min read
Supply Chain
Can an SBOM settle a dependency argument between teams?
An SBOM gives both teams one record of what is in a build, but it must match the deployed artifact. Here is how to use it as neutral evidence.
Oct 19, 20264 min read
Supply Chain
Can an SBOM serve as your third-party SDK and API inventory?
An SBOM covers the SDKs and libraries you ship, but not the APIs you call or why. Here is what it gives you and what you add by hand.
Oct 19, 20263 min read
Supply Chain
Can an SBOM prove a library is not in your product?
An SBOM supports a not present answer only if it is complete, current and made from the right inputs. What to check before saying a library is absent.
Oct 19, 20264 min read
Supply Chain
Can an in-toto attestation statement have an empty predicate?
Yes. In the in-toto Statement v1 spec the predicate is optional, and predicateType can carry the whole meaning. See when that helps and when it is risky.
Oct 19, 20264 min read
Supply Chain
Can a bad release be removed from Maven Central?
Maven Central does not remove or modify published components. That keeps builds repeatable, and it means the fix always has to come from your side.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.