Security
In-depth guides and analysis on security from the Safeguard engineering team.
100 articles
fast-jwt CVE-2026-107722: The Algorithm Confusion Fix That Only Trimmed Whitespace
fast-jwt has now fixed the same RSA-to-HMAC algorithm confusion bug three times. CVE-2026-107722 (CVSS 9.8) shows why trimming whitespace was not enough, who is exposed through @fastify/jwt, and the settings that would have blocked every variant.
Argo CD CVE-2026-55797: A Proxy URL That Runs Commands in the Repo-Server
Anyone who can add or edit an Argo CD repository could run shell commands in the repo-server through an SSH proxy URL. Affected versions, the root cause, what the fix changed, and a script to find risky repository Secrets today.
Ivanti Connect Secure CVE-2026-104935: A Header Picks the Script, the URL Picks the Rules
CISA added Ivanti Connect Secure CVE-2026-104935 to KEV on 13 October. Affected and fixed versions, how the authentication bypass and code execution chain works, why the Integrity Checker misses it, and what to check beyond the upgrade.
From policy to production: defining guardrails once and enforcing them everywhere
Define a guardrail once on the Policy page, compile it into a signed policy bundle, and enforce it with one line of middleware in Node.js, Python, Java, Go and .NET. A walkthrough of how Guard installs and runs.
Runtime guardrails inside your app: what library-level protection catches that a WAF can't
A WAF sees a request, not the SQL query it turns into. How query-structure SQL checks, SSRF checks on resolved IPs, LLM and MCP guardrails, Monitor mode and fail-open work inside the application.
Gold, Gold Live, Gold Zero-Day: coverage over time explained
All three Gold tiers meet the same security bar at build time. They differ in what happens after. Point-in-time, continuous and ahead-of-disclosure coverage, how rebuilds reach your builds, and the targets.
Why patching your dependencies yourself doesn't scale, and what sourcing fixed builds changes
Backporting a fix yourself works for one package. Transitive dependencies, lockfiles and proof make it break at scale. Here's how sourcing fixed, signed builds changes the work, and how to verify them.
A LinkedIn Post Questioned Anthropic's Claude OSS Scanner License. Here Is What It Grants
Anthropic's opt-in OSS Scanner, built on its experience using Claude to find vulnerabilities, asks contributors to sign a contributor license agreement. What that agreement grants Anthropic, what it does not say, and ten questions to ask any AI vendor before you send code.
We Signed CISA's Secure by Design Pledge. Here Is Where We Stand on Each Goal
Safeguard now appears on CISA's list of Secure by Design Pledge signers. The pledge asks for measurable progress on seven security goals within a year. Here is what we already ship for each one, and what we have not done yet.
One Mailbox, Six Spellings: The Signup Bug in Almost Every Product
name+tag@, dotted Gmail, googlemail.com, a zero-width space. All reach one inbox, all pass a uniqueness check, and one common fix locks real users out of accounts they are entitled to.
Device Code Phishing Rose 15x. Checking the URL Does Not Help.
Device code phishing sends victims to a genuine Microsoft page to enter a genuine code. There is no fake domain and no credential to steal. Training built on spotting bad URLs has nothing to use.
CVE-2023-5752: Command Injection in pip via Mercurial Revisions
Installing a package from a Mercurial URL with a crafted revision let attackers inject hg config options. Here is how CVE-2023-5752 works and how to fix it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.