Vulnerability Management
Fuzzing Open Source for Supply Chain Findings
How modern coverage-guided fuzzing finds real vulnerabilities in open-source dependencies, and how to fold it into a supply-chain security program.
Mar 4, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Management
Mean Time to Remediation Benchmarks: How Fast Should You Be Patching?
MTTR is the most important vulnerability management metric. But what is a good MTTR? Industry benchmarks, realistic targets, and strategies for improvement.
Mar 3, 20265 min read
Vulnerability Management
bundler-audit Production Setup
A practical guide to running bundler-audit in production CI pipelines, including advisory database updates, exception handling, and integration with remediation workflows.
Mar 3, 20267 min read
Vulnerability Management
SLO-Driven Vulnerability Management Program
Service-level objectives turn vulnerability management from heroics into a measurable program. Here is how to define SLOs that survive contact with reality.
Mar 1, 20268 min read
Vulnerability Management
Symbolic Execution for Dependency Analysis
Symbolic execution explores program paths without concrete inputs. For supply-chain work, it answers reachability questions that fuzzing cannot.
Feb 28, 20267 min read
Vulnerability Management
False Positive Rates in Container Scanning: Why Your Scanner Lies to You
Container scanners produce mountains of findings. A significant percentage are false positives. Here is how to measure and manage the noise.
Feb 25, 20265 min read
Vulnerability Management
Coordinated Vulnerability Disclosure: A Complete Guide
Coordinated disclosure protects users while giving vendors time to fix. Here is how to run a disclosure process that works for all parties, whether you are the reporter or the vendor.
Feb 24, 20267 min read
Vulnerability Management
Taint Analysis for Zero-Day Discovery: A Primer
A practitioner's walk-through of taint analysis as a zero-day discovery technique, from classic Livshits and Lam foundations to modern flow-sensitive engines.
Feb 23, 20267 min read
Vulnerability Management
Palo Alto GlobalProtect Zero-Day: Response Timeline
CVE-2024-3400 hit GlobalProtect with pre-auth RCE and ongoing exploitation. Here is the response timeline, the UPSTYLE tradecraft, and what worked.
Feb 23, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.