Supply Chain
What does package provenance prove, and what does it not?
Provenance links a package to its source and build, but does not prove the code is safe. What it shows, what it misses, and what to check when asked.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What does NuGet package source mapping not protect against?
Package source mapping filters restore, install and update, but not metadata queries or cached packages. Know these gaps before you rely on it.
Oct 18, 20264 min read
Supply Chain
What manifest-only dependency scanning misses
Older composition analysis reads manifests and stops. Here is what that misses: resolved transitive versions, vendored code, images and reachability.
Oct 18, 20263 min read
Supply Chain
What is a VEX and should a software partner send you one?
A VEX states whether a known vulnerability actually affects a specific product. Learn when to ask a supplier for one and how to read what comes back.
Oct 18, 20263 min read
Supply Chain
What is TUF and how does Sigstore use it for trust?
TUF secures how clients get trusted keys. Sigstore uses it to distribute the roots that verify Fulcio certificates and Rekor entries. Roles explained.
Oct 18, 20263 min read
Supply Chain
What is the OpenSSF Criticality Score, and should you use it?
The Criticality Score rates a project's influence from 0 to 1. It is not a safety rating, and its public data pipeline has stopped. Use these instead.
Oct 18, 20264 min read
Supply Chain
What is the OCI referrers API and why do signatures and SBOMs use it?
The referrers API lists artifacts that point at an image digest, like signatures and SBOMs. See how the endpoint and tag fallback work and what to verify.
Oct 18, 20263 min read
Supply Chain
What is the minimum an SPDX 3 AI package record needs?
SPDX 3.0.1 AIPackage requires eight fields plus license relationships. See the minimum record for a model and the optional AI fields worth adding.
Oct 18, 20264 min read
Supply Chain
What is the integrity field in package-lock.json and what does it check?
The integrity value in package-lock.json is a hash of the package tarball. What it catches, what it cannot, and why lockfile diffs still need review.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.