AI Security
Which vulnerability decisions should an LLM never make alone?
Models can draft and explain, but some calls need a named person: risk acceptance, exceptions, severity overrides and release blocks. A decision map.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Is multi-node vLLM traffic encrypted? What network isolation needs
vLLM's docs say multi-node traffic is insecure by default, and PyTorch Distributed has no auth or encryption. Here is how to isolate the nodes.
Oct 19, 20264 min read
AI Security
Which vLLM flags and variables should never be on in production?
Dev mode, profiler endpoints, runtime LoRA updates and the tokenizer info endpoint each add risky routes. What vLLM's docs say to leave off or guard.
Oct 19, 20264 min read
AI Security
Does the vLLM API key protect every endpoint? No, here is the gap
No. vLLM's API key covers some path prefixes, but its own security docs list inference and control endpoints outside them. Here is how to close the gap.
Oct 19, 20264 min read
AI Security
How do you stop SSRF through multimodal inputs on a vLLM server?
Set an allowlist of media domains, block redirects and cap download sizes. The vLLM docs explain why URL inputs to an inference server become an SSRF risk.
Oct 19, 20264 min read
AI Security
How do you validate an AI-generated patch without trusting the AI?
Treat AI output as untrusted input. Validate patches with deterministic checks on paths, packages, size and tests before a human reads the diff.
Oct 19, 20264 min read
AI Security
Should you trust an AI-suggested security fix? Treat it as untrusted
Treat an AI-suggested fix like a patch from an unknown contributor: read it, test it, rescan it. A step list for verifying it before merge.
Oct 19, 20263 min read
AI Security
Training data, retrieval corpus or prompt: which carries which risk?
An LLM app takes in text through training data, a retrieval corpus and prompts. Each fails differently and needs a different control. A comparison table.
Oct 19, 20264 min read
AI Security
Is a model you pulled for a prototype part of your supply chain?
Yes. Pre-trained models and datasets pulled for a prototype are supply chain inputs. Here are the checks to run before they reach production.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.