Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A dozen OpenTelemetry CVEs landed between 8 September and 2 October 2026, from a ServiceMonitor token leak in the Operator to a webhook auth bypass. Here is which ones reach your pipeline.
Strimzi 1.0.0 and earlier lets anyone who can create a Kafka resource get Secret access in other namespaces. Fixed in 1.0.1 and 1.1.0. A StreamsHub Console token leak followed on 28 September 2026.
Since 1 September 2026 Entra ID auto-enables passkeys for SMS and voice users. Microsoft-provided SMS and voice MFA retires on 1 February 2027, with no opt-out.
From 7 September 2026 Entra self-service password reset only accepts registered authentication methods, not mobilePhone or otherMails directory attributes.
What you may test in your own cloud account without asking, what always needs approval, and three CLI checks to run before a tester touches your environment.
What a tester checks in a Kubernetes cluster, five commands to run first, and why the March 2026 ingress-nginx advisory is a good example of what a test should catch.
How to grant a penetration tester time-limited, read-only access to your AWS account with an assumed role and external ID, and what AWS, Azure and Google Cloud each say about testing.
Since 15 July 2026, new GitHub repositories mint OIDC tokens with owner and repo IDs in the sub claim. Here is how to update AWS trust policies before a deploy fails.
Azure's mandatory MFA covers emergency access accounts too. Microsoft's current guidance says use a passkey (FIDO2) or certificate. Here is the checklist, with the alert query.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
