Supply Chain
Which attestation predicate type do you need? A decision table
Provenance, SBOM, vulnerability scan, test result or VSA: match the in-toto predicate type to the question you need an attestation to answer.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
Where does composer audit get its advisories from?
composer audit asks the Packagist.org security advisories API, which records each advisory source. What the data includes, and what it cannot tell you.
Oct 18, 20263 min read
Supply Chain
After a poisoned build, what do you need to reset?
Reset runners, caches, signing keys, build secrets and base images, then rebuild from a clean commit. A checklist based on the SLSA build threats.
Oct 18, 20263 min read
Supply Chain
What should you index when you store supplier SBOMs?
Store the raw file untouched and index a handful of fields so you can answer who uses this component in seconds. Here is the field list and why.
Oct 18, 20263 min read
Supply Chain
What should you do when an approved MCP server is abandoned?
When an approved MCP server stops getting updates, check its signals, freeze the version, limit its access, plan a replacement and set a removal date.
Oct 18, 20264 min read
Supply Chain
What to do when a vulnerability has no fix available
When a scanner flags a package with no patched version, check reachability, add a mitigation, replace the package, or accept with an expiry date.
Oct 18, 20263 min read
Supply Chain
What should you check before depending on an open source security tool?
Before adopting an open source scanner, check licence, maintenance status, data sources, release cadence and exit path. A short due diligence checklist.
Oct 18, 20263 min read
Supply Chain
What is the root component of an SBOM and why does it matter?
The root component says what an SBOM describes. How SPDX DESCRIBES and the CycloneDX metadata component work, and what breaks when the subject is missing.
Oct 18, 20263 min read
Supply Chain
What can the GitHub dependency graph see, and what does it miss?
The GitHub dependency graph is built from manifest and lock files. See what it covers, where transitive and unsupported cases leave gaps, and fixes.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.