Security
CVE-2023-44794: The Sa-Token Authentication Bypass Explained
A path-normalization mismatch lets attackers bypass route authentication in Dromara Sa-Token. Here is how CVE-2023-44794 works and how to fix it.
Jul 9, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity
How to Prevent Buffer Overflow Vulnerabilities
Preventing buffer overflow comes down to bounds-safe code, compiler and OS protections, and testing. Here is how each defense works and where it fits.
Jul 9, 20266 min read
Incident Analysis
Western Sydney University 2025 Breach: Third-Party Cloud Misconfiguration
From June to September 2025 an attacker quietly accessed a third-party cloud system linked to Western Sydney University and exfiltrated data on 10,000 students. We unpack the supply-chain anatomy.
Jul 9, 20267 min read
Frameworks
MITRE ATT&CK v18: Detection Strategies Replace Data Sources
ATT&CK v18 released October 28, 2025, replacing traditional Detections (Data Sources) with Detection Strategies and Analytics. Here is how the model changes for defenders.
Jul 9, 20267 min read
Compliance
FedRAMP 20x Phase One: 13 of 26 Pilot Reviews Completed
GSA announced FedRAMP 20x on March 24, 2025. By the end of Phase One in late September, FedRAMP had received 26 submissions and completed 13 reviews.
Jul 9, 20265 min read
Policy
ENISA Threat Landscape 2025: Supply Chain Section Decoded
ENISA's October 2025 report analysed 4,875 incidents from July 2024 to June 2025 and found phishing led at 60% of intrusions, with supply chain and slopsquatting as fast-growing vectors.
Jul 9, 20267 min read
AI Security
The Security Chores Agents Should Handle Themselves
Enabling 2FA, rotating a password, revoking a stale session, minting a scoped key — the account-hygiene tasks everyone postpones. When an agent can do them through MCP, 'later' becomes 'now.'
Jul 9, 20264 min read
Tools
Trivy v0.69 Release Deep Dive
Aqua's Trivy hit v0.69 in late 2025 with VEX-by-default scanning, ArtifactID/ReportID provenance fields, and faster misconfig scanning. We test the upgrade on a 1.2GB image.
Jul 9, 20265 min read
AI Security
Region-Blind Pricing Breaks the Moment an Agent Checks Out
Your pricing is localized by country — but an AI agent rarely holds a clean country code. If your checkout can't resolve region from the messy signals an agent actually has, it quotes the wrong price or none at all.
Jul 9, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.