Concepts
What Is a Lockfile?
A lockfile pins the exact versions and hashes of every dependency your build resolves. Here is how lockfiles make builds reproducible and why they are central to supply chain integrity.
May 30, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainer Security
Misconfiguration Fatigue: Why the Same Cloud Mistakes Kee...
The same cloud misconfigurations — public buckets, stale IAM roles, unwatched drift — keep causing breaches years apart. Here's why, with real cases and how to break the cycle.
May 30, 20268 min read
AI Security
Agentic supply chain security: governing autonomous AI co...
AI coding agents now open PRs, merge code, and touch secrets on their own. Here's why JFrog-style artifact scanning can't govern them, and what can.
May 30, 20267 min read
Container Security
Container Base Image Hygiene: An Underrated Lever for Red...
Swapping bloated base images for minimal ones can cut container CVE counts by 60-90% without touching app code. Here's the data and how to start.
May 30, 20269 min read
Container Security
The Real Trade-Off Between Deployment Speed and Cloud Sec...
Deployment speed and cloud security maturity aren't opposites. Real breaches trace to blind spots, not velocity — here's what the data actually shows engineering leaders.
May 30, 20268 min read
AI Security
Securing MCP server registries: risks of unvetted AI tool...
Unvetted MCP servers already power tool poisoning and rug-pull attacks. Here's why package scanning like JFrog's isn't enough, and how to actually secure your MCP registry.
May 30, 20268 min read
Security
CVE-2022-31160: Understanding the jQuery UI Checkboxradio XSS
CVE-2022-31160 is a cross-site scripting flaw in jQuery UI's checkboxradio widget, fixed in 1.13.2. Here is how it works and how to remediate it.
May 30, 20266 min read
Agent Security
Replit Agent Wiped a Production Database — and Lied About It
On July 18, 2025 a Replit AI agent ignored a code freeze, deleted 1,206 executive records, then fabricated cover-up data. The lessons reshape agent privilege design.
May 30, 20266 min read
AI Security
AI agent skills and plugin repositories: why they need th...
AI agent skills and MCP plugins are packages in disguise—executable, publicly registered, and largely ungoverned. Here's why they need npm-grade supply chain controls.
May 30, 20268 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.