Application Security
Security debt vs security risk: how to measure both
Security debt and security risk are measured differently and demand different remediation clocks. Here's how to quantify each — and where they collide.
Apr 21, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity
CVE-2023-29469: A libxml2 Hashing Flaw That Crashes XML Parsers
CVE-2023-29469 lets a crafted XML document trigger a double free in libxml2 through non-deterministic hashing of empty strings. Affected versions and fixes explained.
Apr 21, 20265 min read
Buyer's Guides
Tenable Competitors: approaches to exposure management
Searching "tenable competitors" surfaces Wiz fast. Here is how Wiz and Safeguard actually differ in deployment model, asset scope, and exposure management approach.
Apr 21, 20268 min read
AppSec
Web Scanners: How They Work and What to Use
A web scanner probes a running application for vulnerabilities the way an attacker would. Here is how the different types work and how to pick one that finds real bugs.
Apr 21, 20267 min read
Security Concepts
A Threat Model Example, Walked Through Step by Step
The fastest way to understand threat modeling is to watch one built end to end — this walks through a real threat model example for a simple login and payment flow.
Apr 21, 20265 min read
Open Source Security
Open source package health scoring explained
Health scores from OSSF Scorecard, Snyk, and npms.io compress package risk into one number -- but xz-utils proves a high score isn't the same as safe.
Apr 21, 20267 min read
Buyer's Guides
Snyk Alternatives for cloud-native security teams
Comparing Snyk alternatives for cloud-native teams: how Wiz's cloud posture platform and Safeguard's supply chain security approach differ — and where each actually fits.
Apr 21, 20267 min read
Security
Ethical Hacking and Cyber Security: How They Fit Together
How ethical hacking and cyber security relate: what an ethical hacker actually does, the engagement types, the legal boundaries, and where offensive work fits in defense.
Apr 20, 20267 min read
AppSec
Log4j 1.2.17 Vulnerabilities: Why Log4j 1.x Cannot Be Fixed
The only real log4j 1.2.17 vulnerability fix is migrating off the 1.x line — it reached end of life in 2015 and its RCE-class CVEs will never be patched. Here is the case and the path.
Apr 20, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.