Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A setup guide for push protection with a bypass list and review role, plus what GitHub's July and October 2026 secret scanning changes mean for billing and alert handling.
Since 26 March 2026 GitHub's credential revocation API covers OAuth and GitHub App tokens as well as PATs. How to use it on a token you found, and what it does not do.
Device Bound Session Credentials reached public availability in Chrome 146 on Windows in April 2026. What it protects, what it does not, and what a web app must add.
Disabling a directory account leaves personal tokens, deploy keys and live sessions behind. A checklist for when an engineer or contractor leaves, built from AWS, GCP, GitHub and Microsoft docs.
Vikunja's CVE-2026-68582 loaded an object before checking access. Here is a repeatable two-user test routine that finds this class of bug in your own API before an advisory does.
PraisonAI, 9Router and FreeScout all shipped SSRF checks that looked right and still failed. What went wrong in each, and how to build a fetch path that holds.
A scanner built to catch malicious pickles was itself bypassed, and a labeling library loads pickles from any path. What actually works in Python, Java, .NET and PHP.
Spring patched a static resource traversal on June 8, 2026. The fix pattern, and the equivalent safe file-serving code for Flask, Node and Go, in one reference.
Perry skipped expiry checks, jose-swift accepted alg none, PyJWT trusted a public key as a secret. One checklist that would have caught all three in your own verify code.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
