AI Security
MCP server security: 7 permission and trust mistakes teams make
Seven MCP mistakes drawn from the official spec, from broad scopes to token passthrough to local servers run without review, with a fix list for each.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
What should you log and alert on for LLM unbounded consumption?
OWASP LLM10 covers floods, denial of wallet and model extraction. A defensive plan: the fields to log, the alerts to set and the limits to enforce.
Oct 18, 20265 min read
AI Security
LLM10 unbounded consumption: controls that work and ones that do not
OWASP LLM10 covers denial of service, runaway cost and model theft. Rate limits, quotas, timeouts and budgets work. A hidden endpoint does not.
Oct 18, 20264 min read
AI Security
LLM08 vector and embedding weaknesses, explained with a RAG example
OWASP LLM08 covers leaks, poisoning and inversion in RAG systems. A hiring screen scenario from OWASP shows the risk and the controls that reduce it.
Oct 18, 20264 min read
AI Security
LLM08 vector and embedding weaknesses: controls that work
OWASP LLM08 covers RAG risks like leakage, poisoning and inversion. Which controls address them, and why prompt instructions alone do not. Defensive guide.
Oct 18, 20264 min read
AI Security
LLM07 system prompt leakage: what should you log and alert on?
OWASP LLM07 says treat the system prompt as public. So log what the prompt could expose, alert on outputs that echo it, and keep secrets out of it.
Oct 18, 20264 min read
AI Security
OWASP LLM07 system prompt leakage: what auditors will ask
OWASP says a system prompt is not a secret or a security control. Here is how LLM07 maps to NIST AI RMF practices and what evidence to keep for audits.
Oct 18, 20265 min read
AI Security
LLM06 excessive agency: which compliance controls it maps to
OWASP LLM06 excessive agency has three root causes. How each lines up with least privilege, human oversight and AI risk frameworks, plus a checklist.
Oct 18, 20265 min read
AI Security
LLM05 improper output handling: what to log and alert on
OWASP LLM05 is about trusting model output downstream. Log every handoff from model to code and alert on validation failures and odd patterns.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.