Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
fast-jwt has now fixed the same RSA-to-HMAC algorithm confusion bug three times. CVE-2026-107722 (CVSS 9.8) shows why trimming whitespace was not enough, who is exposed through @fastify/jwt, and the settings that would have blocked every variant.
Anyone who can add or edit an Argo CD repository could run shell commands in the repo-server through an SSH proxy URL. Affected versions, the root cause, what the fix changed, and a script to find risky repository Secrets today.
CISA added Ivanti Connect Secure CVE-2026-104935 to KEV on 13 October. Affected and fixed versions, how the authentication bypass and code execution chain works, why the Integrity Checker misses it, and what to check beyond the upgrade.
Define a guardrail once on the Policy page, compile it into a signed policy bundle, and enforce it with one line of middleware in Node.js, Python, Java, Go and .NET. A walkthrough of how Guard installs and runs.
A WAF sees a request, not the SQL query it turns into. How query-structure SQL checks, SSRF checks on resolved IPs, LLM and MCP guardrails, Monitor mode and fail-open work inside the application.
All three Gold tiers meet the same security bar at build time. They differ in what happens after. Point-in-time, continuous and ahead-of-disclosure coverage, how rebuilds reach your builds, and the targets.
Backporting a fix yourself works for one package. Transitive dependencies, lockfiles and proof make it break at scale. Here's how sourcing fixed, signed builds changes the work, and how to verify them.
Anthropic's opt-in OSS Scanner, built on its experience using Claude to find vulnerabilities, asks contributors to sign a contributor license agreement. What that agreement grants Anthropic, what it does not say, and ten questions to ask any AI vendor before you send code.
Safeguard now appears on CISA's list of Secure by Design Pledge signers. The pledge asks for measurable progress on seven security goals within a year. Here is what we already ship for each one, and what we have not done yet.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
