Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Pingora before 0.9.0 let a client's Connection header make a later proxy drop X-Forwarded-For, bypassing IP checks. Who is affected and how to fix it.
DHS FASCSA Order 2026-01 excludes and removes DeepSeek products from civilian agency IT. What the order says and how suppliers inventory DeepSeek use.
BOOKOFF says 6,427,735 member records (6,383,279 people, 212,371 ex-members) left its system with password hashes. What leaked and what to change now.
Lawson says a third party abused the app mechanism that shows users their own data, exposing 2,155,345 LAWSON ID records. What leaked and what to test.
fast-uri, the URI parser under ajv and Fastify, fixed four CVEs on 19 October in 2.4.8, 3.1.9 and 4.2.3. What each bug does and how to find old copies.
Malicious Electrum servers swapped just-broadcast payments for fakes, then waited for a fee bump. Upgrade to 4.8.3 and check outputs before signing.
CVE-2026-113351: libexpat 2.7.2 to 2.9.0 reset parsers reject every later XML document. Fix merged 23 Oct, no release yet. Who is affected, what to do.
Rails 8.0 security fixes end 7 Nov 2026. It got 10 advisory fixes in 2026, one critical. 8.1 needs the same Ruby. Versions, removals and upgrade steps.
Eight problems worked in Vedic sutras, Chinese rods and suanpan, Japanese soroban and the school method, with step counts and what the evidence says.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
