Supply Chain
What is reachability analysis, and do you need it in a scanner?
Reachability analysis checks whether your code can call a vulnerable function. See what it does, where it helps, where it cannot, and who needs it.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What is NuGet package ID prefix reservation and what does it prove?
Prefix reservation blocks other owners from publishing IDs under a reserved prefix on nuget.org and adds a visual indicator. It is a hint, not a guarantee.
Oct 18, 20263 min read
Supply Chain
What is namespace squatting and how do registries limit it?
Namespace squatting is claiming a name, scope or prefix you do not own. See how npm scopes, NuGet ID prefixes and Maven group IDs reduce the risk.
Oct 18, 20263 min read
Supply Chain
What is the elephant factor of an open source project?
Elephant factor counts the fewest companies behind half a project's commits. Learn how to read it, where it misleads, and how it differs from bus factor.
Oct 18, 20263 min read
Supply Chain
What is an OCI image manifest and how is it different from an index?
An OCI image manifest lists the config and layers of one image for one platform, while an index points to many manifests. Contents and why digests matter.
Oct 18, 20263 min read
Supply Chain
What is an npm install script and when does it run?
An npm install script is a command a package asks npm to run during install. See which scripts fire, why attackers like them, and how to spot them.
Oct 18, 20263 min read
Supply Chain
What is a Swift package registry and how does it verify downloads?
A Swift package registry is an HTTPS service that hosts packages by scope and name. Learn how checksums and signatures work and what they do not prove.
Oct 18, 20263 min read
Supply Chain
What is a SLSA verification summary attestation (VSA)?
A VSA is a signed record that a verifier checked an artifact against a policy and found which SLSA level it met. Fields, checks and limits explained.
Oct 18, 20264 min read
Supply Chain
What is a shaded JAR and why do scanners miss what is inside?
A shaded JAR copies dependencies into one file and may rename packages. See why that hides vulnerable libraries from manifest scanners and how to check.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.