SBOM
CycloneDX 1.7 Migration Guide From 1.5
A practical migration path from CycloneDX 1.5 to 1.7 covering schema changes, machine learning BOM additions, formulation, and the tooling adjustments required.
Mar 22, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity
The Bootstrap Freelancer Theme: A Security Review Before You Ship It
The Bootstrap Freelancer theme is a popular free portfolio template, but shipping it unchanged pulls in front-end dependencies you need to check first.
Mar 22, 20266 min read
Vulnerability Analysis
Use of Components with Known Vulnerabilities
Equifax lost 147M records to one unpatched library. Here's what "components with known vulnerabilities" means and how reachability analysis fixes the triage problem.
Mar 22, 20266 min read
Container Security
How a Docker Image Vulnerability Scanner Works and What to Use
How a Docker image vulnerability scanner works layer by layer, what it can and cannot catch, the tools worth knowing, and how to wire scanning into your build without slowing it down.
Mar 22, 20267 min read
Regulatory Compliance
EU AI Act and ISO 42001: how the two frameworks interact
How the EU AI Act's binding rules and ISO 42001's voluntary AIMS overlap, and how supply-chain evidence closes gaps generic GRC tools can't.
Mar 22, 20268 min read
Security
Java Deserialization Vulnerabilities: How They Work and How to Stop Them
A practical explanation of the Java deserialization vulnerability class: why untrusted object deserialization leads to remote code execution, and how to defend against it.
Mar 22, 20266 min read
Container Security
What is Container Security
Container security protects images, runtimes, orchestration, and hosts. Here's what it covers, why 87% of images ship with critical CVEs, and how to fix it.
Mar 22, 20267 min read
DevSecOps
How to Apply a Patch in Git (Safely and Reviewably)
Applying a patch in Git comes down to git apply versus git am, and knowing which to use, how to preview it, and how to verify it, keeps untrusted diffs from becoming a supply chain problem.
Mar 22, 20266 min read
Industry Analysis
Quantitative vs qualitative risk analysis methods
Software supply chain risk needs numbers and judgment. Here's how Safeguard's quantitative scoring compares to Vanta's qualitative, compliance-first approach.
Mar 22, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.