Supply Chain
Will this library backport security fixes to the version I use?
Before you adopt a library, find out if it patches older releases or only the latest. How to read support policies, LTS lines and semver signals.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Why is my SBOM missing components? A troubleshooting checklist
Missing SBOM components usually trace to the input source, scope settings, vendored code, or the build stage scanned. Use this checklist to find which.
Oct 18, 20263 min read
Supply Chain
Why do version schemes matter for C++ dependency vulnerability matching?
vcpkg has four version schemes and refuses to compare across them. That affects how you match a library version to an advisory range. What to record.
Oct 18, 20263 min read
Supply Chain
Why do statically linked binaries ignore your apt upgrades?
A statically linked program carries its own copy of libraries, so OS patches never reach it. Rebuild and scan the binary, as with Go and govulncheck.
Oct 18, 20264 min read
Supply Chain
Why sshd loaded liblzma: the xz backdoor's indirect path
OpenSSH does not use xz directly. How a distribution patch and libsystemd pulled liblzma into sshd, and what that says about transitive dependencies.
Oct 18, 20263 min read
Supply Chain
Why should you sign and verify the image digest, not the tag?
Tags can be moved, digests cannot. Signing and verifying by digest ties trust to exact bytes. Why it matters and how to pin it in your pipeline.
Oct 18, 20263 min read
Supply Chain
Why PyPI advisory counts jumped in 2026: PYSEC mirrors of GHSA records
4,319 PYSEC records carry a 2026 date, against about 300 a year before, and 98% alias a GitHub advisory. A rise in records is not a rise in flaws.
Oct 18, 20263 min read
Supply Chain
Why can one small software library affect so many products?
Software reuses shared libraries, so one flaw in one library can reach every product that includes it. A plain explanation of the dependency web.
Oct 18, 20263 min read
Supply Chain
Why does npm audit miss scripts you load from a CDN?
npm audit reads your dependency tree and lockfile, so scripts loaded by URL or vendored into a folder never appear. Here is how to cover the gap.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.