Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
npm audit signatures checks that installed packages carry valid registry signatures and provenance attestations. Here is the command, real output, and its limits.
What a VEX statement says, the four status values, and the five justifications, shown by generating a real OpenVEX document with vexctl v0.4.4.
npm has a built-in sbom command. We ran it on a 23 package project in both formats, inspected the output, and fed it to a scanner. Commands and real results.
Enterprise buyers now put SBOM requests in questionnaires. Use CISA's 2025 draft minimum elements as the checklist, and send something accurate rather than something big.
Cosign v3.1.3 and v2.6.5 fix a High advisory where identity pinning is skipped for legacy JSON bundles. Image verification is not affected, but blob checks may be.
CISA's 2025 draft says what an SBOM must cover and what it need not. Use it to decide what stays out of the file you send a customer, and how to mark the gaps honestly.
We generated both SBOMs for one tiny Node app with Syft and compared them. The numbers show why a customer who asks for an SBOM needs to know which one you mean.
A working routine for small teams that answer customer vulnerability questions with OpenVEX, using the v0.2.0 spec and vexctl v0.4.4 from June 2026.
SLSA v1.2 landed on 24 November 2025. Here is what a small team can publish with every release so a customer can verify who built it and from what, using GitHub attestations and npm trusted publishing.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
