Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
AWS Config added 77 resource types on 7 October 2026. Use that moment to check storage exposure at four levels with the AWS CLI and managed Config rules.
AWS closed CloudTrail Lake to new customers and added identity filters for network events in 2026. Here is the trail setup every multi-account estate should have.
What the IaC page says about formats, plan time gating, drift detection and policies, and which claims to test on your own repository.
Hardened base images, an immutable digest, a signature and an SBOM on every tag. What the page lists and how to check it yourself with cosign.
Istio's 15 October bulletin fixes an AuthorizationPolicy bypass over HTTP/2, an ambient istiod crash and two Envoy filter crashes. Versions, checks and fixes.
An init-order bug let External Secrets Operator's webhook generator read Secrets not labeled for it and send them to any URL. Fixed in 1.3.2, disclosed 6 October.
Two Argo Workflows advisories from 18 September: bucket object keys that write outside the workspace, and a field selector that leaks other tenants' archived workflows.
Kyverno's 10 September advisories: a tenant's namespaced Policy could make Kyverno create cluster objects, and image verification exceptions exempted every image.
Traefik's September advisories cover a critical HTTP/3 NTLM connection reuse bug and requests that slip past routers and middleware. Versions, checks and fixes.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
