Concepts
What is an SBOM Drift
SBOM drift is the gap between what your software bill of materials claims and what the artifact actually contains. Here's how it happens and how to detect it with a diff.
Mar 11, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDevSecOps
Docker Hub Rate Limit Changes and CI Impact
Docker's 2024 rate-limit reforms hit CI pipelines hard. Measured impact on 30 real build farms and the mirror and pull-through controls that fixed it.
Mar 11, 20265 min read
Best Practices
GCP Pub/Sub Security Configuration
A working security configuration for GCP Pub/Sub: topic and subscription IAM, message encryption, VPC Service Controls, dead-letter handling, and the failure modes that turn a messaging layer into an attack surface.
Mar 11, 20267 min read
Release
Safeguard v3: Compliance-First Supply Chain Security
Safeguard v3 adds compliance framework mapping, automated evidence collection, audit-ready reporting, and VEX document support for regulatory readiness.
Mar 11, 20266 min read
SBOM
SBOM Adoption in 2024: Enterprise Survey Results and Reality Check
Despite growing regulatory pressure, enterprise SBOM adoption remains uneven. A look at where organizations actually stand with SBOM generation, consumption, and operationalization.
Mar 11, 20266 min read
Industry Analysis
Volt Typhoon: Living-Off-the-Land and Supply Chain
The PRC-linked pre-positioning group that scared DHS and the NSA into a public warning, and what it means for supply chain defenders.
Mar 11, 20266 min read
DevSecOps
GraphQL Supply Chain Security Considerations
Supply chain risks specific to GraphQL stacks: Apollo, graphql-js, persisted queries, introspection, and transitive risk in gateway federation.
Mar 11, 20265 min read
AI Security
AI Data Security Solutions: What Actually Protects Your Data?
AI data security solutions cover the tools and controls that protect the data flowing into, through, and out of AI systems. Here is what the category really includes and how to evaluate it.
Mar 11, 20267 min read
AppSec
Software Security Testing: A Practitioner's Overview
Software security testing spans static analysis, dynamic testing, dependency scanning, and manual review — a practical map of which method catches what, written for people who actually run these programs.
Mar 11, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.