Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Lazarus Operation FlashHole wraps payloads for South Korean firms in ML-KEM-1024. How the chain works, the published IOCs, and how to hunt for it.
LiteLLM says GitHub CLI tokens sat in an exposed gateway's logs and opened its release pipeline. How the chain worked and the controls that break it.
CISA added exploited SiteGuard Server Edition and Siemens Software Center flaws to KEV on 20 Oct. Versions, IOCs, detection steps and fixes for both.
Capcom says a third party accessed CAPCOM ID data: 11,774,247 emails with login metadata, 196 passwords changed. No card data. Expect phishing.
Yes, a gateway holds every provider key, prompt and log, so it is a prime target. Isolate it, pin it by hash or digest, scope keys and never log secrets.
Often yes, if you treat it as unreviewed code: check install scripts, dependencies and maintainers, run it isolated with no credentials, then pin it.
There is no separate SOC 2 for AI. Auditors map models, agents and AI vendors to the same criteria. Here is the evidence they ask for and how to prepare.
Infostealers copy browser cookies, CLI tokens and AI agent logins from developer laptops. What they take, how it spreads, and how to limit the damage.
ClickFix tricks people into pasting and running an attacker's command themselves. Here is how it works, what Chrome now catches, and how to stop it.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
