Supply Chain
Signing and provenance myths vs facts: 8 common misunderstandings
Eight myths about signatures, SLSA provenance and attestations, set against what the specifications actually say. Short, sourced and easy to share.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What is single maintainer risk in open source, and should you care?
Many popular open source projects are run by one or two people. What that means for a company that relies on them, and cheap steps to reduce the exposure.
Oct 18, 20263 min read
Supply Chain
What happens to images with no policy in the sigstore policy controller?
Without no-match-policy configured, the policy-controller rejects images no policy matches. Set warn, allow or deny on purpose before you label namespaces.
Oct 18, 20264 min read
Supply Chain
CM-14 signed components and SI-7 integrity checks for software builds
NIST 800-53 CM-14 blocks unsigned components from installing, and SI-7 detects unauthorized change. Here is how they map to build and deploy.
Oct 18, 20264 min read
Supply Chain
How do you show provenance for internal code and third-party parts?
A buyer asks you to show provenance. SSDF defines it, task PS.3.2 says what to keep, and an SBOM is one carrier. Steps and evidence for each kind of code.
Oct 18, 20263 min read
Supply Chain
Should you turn off auto-updates because of malicious updates?
A decision guide: staged updates beat both blind auto-update and never updating. Here is how to weigh malicious update risk against unpatched risk.
Oct 18, 20263 min read
Supply Chain
Should you trust vulnerability data embedded in a supplier SBOM?
Vulnerability entries inside a supplier SBOM are a snapshot, not a verdict. Learn when to use them, when to rematch, and how to record the difference.
Oct 18, 20263 min read
Supply Chain
Should you require an NDA before sharing an SBOM?
When an NDA or usage terms make sense for sharing an SBOM, when public sharing is simpler, and which terms matter, based on NTIA access control guidance.
Oct 18, 20263 min read
Supply Chain
Should you pin GitHub Actions to a commit SHA instead of a tag?
Pin third party actions to a full length commit SHA from the action's own repository. Tags can move. Here is the trade-off and how to review it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.