Security
What Is a Risk Score in Vulnerability Management?
A risk score turns raw severity into a prioritized number by factoring in exploitability, exposure, and business context. Here is how to read and build one.
May 10, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
SEC cybersecurity disclosure rules for public companies
The SEC's 2023 rules give public companies four business days to disclose material cyber incidents. Here's what triggers the clock, and how supply chain visibility keeps you compliant.
May 10, 20267 min read
Threat Intelligence
Malicious NuGet package campaigns targeting developers
Socket.dev has tracked malicious NuGet packages stealing wallets, banking credentials, and sabotaging industrial systems. See how Safeguard catches them first.
May 10, 20268 min read
Containers
Docker Image Security Scan: How to Scan Images for Vulnerabilities
A Docker image security scan inspects the layers of an image for known-vulnerable packages before you ship it. Here are the tools, commands, and the workflow that keeps scanning useful.
May 9, 20266 min read
AppSec
sanitize-html Vulnerabilities: History and Correct Configuration
A walk through the real npm sanitize-html vulnerabilities, from the 2016 recursion bypass to the 2024 style-attribute leak, and the configuration that keeps the library safe.
May 9, 20267 min read
Security
PHP Security Issues: The Vulnerabilities That Still Bite in 2025
Most PHP security issues come down to a handful of repeatable mistakes: unsanitized input, weak session handling, and outdated dependencies. Here is what breaks and how to fix it.
May 9, 20265 min read
DevSecOps
Is node:18-alpine Still Safe to Use in 2025?
The node:18-alpine image is small and popular, but Node.js 18 reached end of life in April 2025. Here is what that means for your containers and how to migrate cleanly.
May 9, 20265 min read
Compliance
Software Licensing, and Why It Is a Supply Chain Problem
Software licensing is the legal layer of your dependency tree, and getting it wrong carries real risk. Here is what the term covers and how open source licenses sneak into your product.
May 9, 20266 min read
Open Source
Rimraf npm: Is It Still Worth Installing in 2025?
A security-minded look at the rimraf npm package — what it does, why old versions throw deprecation warnings, and when Node's built-in fs.rm makes it optional.
May 9, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.