Supply Chain
Typosquatting, dependency confusion, slopsquatting: what differs?
Plain language comparison of typosquatting, dependency confusion, namespace squatting and slopsquatting: who is tricked and which defense fits.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
The Update Framework for firmware: what TUF protects against
TUF adds signed metadata so devices can spot stale updates, rollbacks, mix-and-match files and compromised keys. What the project says it defends against.
Oct 18, 20263 min read
Supply Chain
Trivy March 2026 compromise: timeline and what it touched
A timeline of the March 2026 Trivy compromise per Wiz Research: the binary, the GitHub Actions, the Docker Hub images and the checks defenders ran.
Oct 18, 20263 min read
Supply Chain
Do transitive dependencies need approval under an open source policy?
You cannot hand approve every transitive package, but you can set rules for them. See what to check, what to block and direct versus inherited scope.
Oct 18, 20263 min read
Supply Chain
Transferring a repository to a new owner: what moves, what breaks
Handing a project to a new owner on GitHub keeps issues and history but also carries secrets and changes packages. A checklist to avoid opening a hole.
Oct 18, 20263 min read
Supply Chain
tj-actions and reviewdog: two GitHub Actions, one incident window
CISA's alert ties CVE-2025-30066 and CVE-2025-30154 together. The exact windows, what could leak, and how to work out which secrets to rotate.
Oct 18, 20263 min read
Supply Chain
Find the SDKs and subprocessors that receive your users' data
Every analytics, payment and support SDK may receive user data. Inventory them from dependencies, traffic and vendor accounts, and keep records current.
Oct 18, 20263 min read
Supply Chain
What is a Terraform provider source address and why check it?
A source address like hashicorp/aws tells Terraform which registry and namespace to trust. How omitted hostnames work and what to check in review.
Oct 18, 20263 min read
Supply Chain
How can you tell if a partner's SBOM is complete or just for show?
A practical test for a supplier's SBOM: check the seven baseline fields, compare against lockfiles and images, and ask how often it is refreshed.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.