Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Human in the loop means a person reviews or approves what an AI does. Learn when to require it, what the EU AI Act says and how to avoid rubber-stamping.
Gate irreversible agent actions with a human who sees the exact action. Sort actions by reversibility, bind approvals and avoid click fatigue.
Prefer safetensors, pin a full commit hash, check the publisher, read the pickle import list, and load in a sandbox. A short checklist for ML teams.
Use safetensors, signed commits, CI trusted publishers and Sigstore model signing so consumers can verify who published your model and its integrity.
Hugging Face has no lockfile, but a full commit hash in the revision argument gives the same guarantee. Record it, cache it, and verify before every deploy.
Malicious models usually hide code in pickle imports. Learn the warning signs, what Hub scans cover and miss, and how to contain a model you loaded.
Pin model IDs to the exact organization and a commit, prefer safetensors, leave remote code off, and keep model names in config you review as a dependency.
Treat AI-written code as untrusted input, limit what coding agents can touch, and keep human review and tests in the loop. A practical guide from NIST.
List every model, dataset, library and tool your AI system depends on, then rate trust and impact for each. A method built on NIST, MITRE ATLAS and OWASP.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
