25 supply chain security terms, explained in plain language and backed by live data from the Gold index.
Common Vulnerabilities and Exposures — the global catalog of publicly disclosed security flaws.
Common Vulnerability Scoring System — a 0–10 severity score for vulnerabilities.
A weakness in software that an attacker can exploit to compromise a system.
A vulnerability unknown to the vendor and public — attackers have a head start.
Working code or technique that turns a vulnerability into an actual attack.
Common Weakness Enumeration — the taxonomy of software weakness types.
Software Bill of Materials — the complete ingredient list of a piece of software.
Protecting software from compromise through the components and tools used to build it.
Malicious code hidden in software — in open source, often via hijacked or typosquatted packages.
Knowing and honoring the legal terms of every open-source component you ship.
Verifiable origin: where a component came from and how it was built.
A language's package universe — npm for JavaScript, PyPI for Python, crates.io for Rust.
A packaged filesystem (OS layers + app + dependencies) that runs as a container.
Zero high & critical vulnerabilities, malware-free, license-compliant, with verified provenance — carrying Safeguard Attestation Level 0.
A Model Context Protocol server — a tool backend AI assistants connect to.
Trained model artifacts — weights and code that carry their own supply-chain risks.
Software whose source code is public — free to use, inspect, modify, and share.
A reusable unit of code distributed through a registry — the building block of modern software.
Any third-party building block in your software: packages, container images, AI models, MCP servers.
A component your code needs to run — including the ones your dependencies need (transitive).
The evidence-based checks behind every Gold listing: scanned, analyzed, and re-checked continuously.
Safeguard's analysis engine: deep binary, behavioral, and code-pattern analysis of components.
The concrete path from vulnerable to safe — usually an upgrade to a fixed version.
Curated, current knowledge of active threats — which flaws are being exploited, where, and how.
US federal security authorization for cloud services — the compliance bar for government software.