Open Source
http-proxy-middleware on npm: Security Review and Safe Usage
http-proxy-middleware is a widely used npm proxy library that has shipped two notable CVEs. Here is what to pin, what to patch, and how to use it safely.
May 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Asana MCP Cross-Tenant Leak: A SaaS Connector Failure Mode
From May 1 to June 17, 2025, Asana's MCP server exposed records from one customer's workspace to another. The bug was a textbook authorization break wearing an AI label.
May 18, 20267 min read
AppSec
What Is a DAST Scan? Dynamic Application Security Testing Explained
A DAST scan tests your running application from the outside, the way an attacker would, finding the vulnerabilities that only appear when code, config, and runtime meet.
May 18, 20266 min read
Security
PyPI Malware Today: How Attacks Reach Your Builds Now
PyPI malware today mostly arrives through typosquatting, dependency confusion, and malicious install scripts. Here is how the current attack patterns work and how to defend your pipeline.
May 18, 20266 min read
Regulatory Compliance
UK Cyber Security and Resilience Bill (May 2026): Report Stage, Supply Chain, and the 24-Hour Clock
By May 2026 the UK's Cyber Security and Resilience Bill has cleared Commons committee and is heading to Report stage. We analyze its expanded scope, the 24-hour incident reporting requirement, and the supply chain obligations software vendors should prepare for.
May 18, 202611 min read
Container Security
CVE-2026-42945: A Buffer Overflow in NGINX's Rewrite Module Reaches Into Your Kubernetes Clusters (May 2026)
Disclosed May 17, 2026 with public PoC and in-the-wild activity, CVE-2026-42945 is a buffer overflow in NGINX's ngx_http_rewrite_module. It affects core NGINX and the ingress controllers that wrap it, putting cluster ingress in scope.
May 18, 202612 min read
Open Source
react-native-fs: What to Know Before You Depend On It
react-native-fs gives React Native apps native filesystem access, but its maintenance status and the way you handle paths both carry real security weight.
May 18, 20265 min read
Open Source
React Fast Marquee: A Security and Maintenance Guide
React Fast Marquee is a lightweight scrolling-marquee component for React. Here is an honest look at its risk profile, maintenance status, and how to use it safely.
May 18, 20265 min read
Security
nginx 1.18.0 CVEs: Which Vulnerabilities Affect You and How to Patch
A look at the CVEs that affect nginx 1.18.0, why running an end-of-life stable branch is the real risk, and the safest path off it.
May 18, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.