Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Miri wrote every environment variable into target/. If your CI caches that directory and pull requests can read the cache, secrets were exposed. Here's how to check.
The crates.io team says attackers are luring Rust maintainers into video calls, then asking them to install a codec or paste a command. Here's what to check.
GHSA-j5m7-59rp-24f5: Gradle kept searching later repositories after a TLS handshake failure, letting a lower-priority repo serve the artifact. Fixed in 9.8.1.
Since 15 October, rubygems.org flags vulnerable and malicious gem versions using hourly OSV data. gem install and bundle install don't change yet.
PyPI now checks new account emails against a reputation service and rejects disposable addresses. Outlook and Hotmail, blocked since June 2024, work again.
From 23 September 2026 Microsoft signs NuGet packages with a new author certificate. Teams that pin trusted signers must add the new fingerprint or restores fail.
Swift 6.4, released 15 September, lets SwiftPM write CycloneDX 1.7 and SPDX 3.0 SBOMs. Here are the commands, what's included and what's still missing.
GitHub finished rolling out stateless App installation tokens on 2 October 2026. They keep the ghs_ prefix but grow from 40 to about 520 characters.
Since 14 October 2026 GitHub rejects new RSA keys under 3072 bits and offers post-quantum key exchange. SHA-1 ssh-rsa brownouts start 4 November.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
