Cloud Security
Why static scanning misses runtime threats (the case for ...
Trivy's build-time CVE scans miss fileless malware, reverse shells, and live threats. Here's how ATT&CK-mapped runtime protection closes the gap.
Apr 28, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedProduct
Safeguard IDE Extension v5: Security Feedback Where Developers Actually Work
The Safeguard IDE Extension v5 brings SBOM generation, vulnerability alerts, and policy checks directly into VS Code and JetBrains IDEs. A deep dive into what changed and why it matters.
Apr 28, 20267 min read
Software Supply Chain Security
Securing IoT device firmware supply chains
How Ripple20, Mirai, and Realtek SDK flaws exposed IoT firmware supply chains, what EU CRA and FDA SBOM rules require, and what reachability adds.
Apr 28, 20267 min read
AppSec
Application Security Scanning: How the Pieces Fit Together
Application security scanning spans SAST, DAST, SCA, and secrets detection. Here is what each type finds, where it fits in CI, and how to avoid alert fatigue.
Apr 28, 20266 min read
Buyer's Guides
What is Trivy and how it compares to other open-source sc...
Trivy is Aqua Security's free open-source scanner for containers, IaC, and dependencies. Here's how it compares to Grype, Clair, and Snyk—and where it falls short.
Apr 28, 20268 min read
Open Source
react-native-loading-spinner-overlay: Is It Still Safe to Use?
A security look at react-native-loading-spinner-overlay: its maintenance status, dependency footprint, and how to reason about an unmaintained UI package.
Apr 27, 20265 min read
Compliance
Permissive License Explained: MIT, Apache 2.0, and BSD Risks
What a permissive license is, how MIT, BSD, and Apache 2.0 differ, and the compliance and security risks teams overlook when they assume permissive means risk-free.
Apr 27, 20266 min read
Compliance
NIST CVE Data Explained: How the NVD Works and Why the Backlog Matters
What NIST's role in CVE data actually is, how the NVD enriches records with CVSS and CPE, and why the 2024 analysis backlog changed how teams should consume it.
Apr 27, 20266 min read
AppSec
The OWASP Top 10, Explained: The Web App Risks That Matter Most
The OWASP Top 10 is the industry's reference list of the most critical web application security risks. Here is what each category means and how to defend against it.
Apr 27, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.