Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
On September 24, 2025, crates.io removed faster_log and async_println — Rust typosquats that had quietly stolen Ethereum and Solana keys from 8,424 downloads since May.
A concrete look at Kubernetes runtime security tools — Falco, Tetragon, Tracee, eBPF, and recent CVEs — and what to check before you buy one.
A code scanning tool automatically inspects your source and dependencies for vulnerabilities. Here is how the main types differ and how to wire one into CI without drowning in noise.
Why SOC 2 Type II compliance is the real trust signal for AppSec vendors, where Checkmarx's public evidence falls short, and how Safeguard makes its audit trail verifiable.
Wiz documented active exploitation of Pandoc CVE-2025-51591 to reach the AWS IMDS through iframe rendering. Here is the kill chain and the production controls that contained it.
Scorecard v5.1 added experimental Azure DevOps repository support and a new --file-mode flag that materially changes how repository files are fetched.
The exceljs npm package is a maintained, popular library for reading and writing Excel files, and it is a reasonable choice, but parsing untrusted spreadsheets carries real risk. Here is the review.
An honest guide to the best SBOM tools in 2026 — from open-source generators like Syft and Trivy to full SBOM management and AIBOM platforms — with clear guidance on which to use for generation, analysis, and compliance.
An authenticated stack buffer overflow in Cisco IOS and IOS XE SNMP is being exploited in the wild. We dissect the bug, the patch, and the detection signal.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
