AI Security
MCP Server Sandbox Escapes: Threat Model
A threat model for sandbox escapes in Model Context Protocol servers, mapping attack surfaces from tool execution environments to host processes and shared state.
Mar 25, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
GitHub Actions Immutable Actions GA: Why OCI-Backed Action Distribution Closes the tj-actions Class of Attack
GitHub's 2026 roadmap puts Immutable Actions GA at the center of Actions supply-chain hardening, publishing actions as OCI artifacts with hash-mismatch fail-fast and full composite-action visibility.
Mar 25, 20266 min read
Best Practices
Flowing Down CMMC And CRA Clauses To Vendors
CMMC 2.0 and the EU Cyber Resilience Act both require obligations to flow down through your supply chain. Here is how to write the clauses and verify the compliance.
Mar 25, 20267 min read
DevSecOps
Developer Friction Budget For Supply Chain Tools
Every security tool spends developer attention. A framework for budgeting friction across IDE, CLI, and PR-time supply chain checks without going bankrupt.
Mar 25, 20268 min read
Security
How to Hash a Password in Java the Right Way in 2025
To hash a password in Java, use a slow, salted, adaptive algorithm like bcrypt or Argon2 — never a raw SHA or MD5 digest. This guide shows working code and the tuning that actually matters.
Mar 25, 20265 min read
Vulnerability Analysis
What is Social Engineering
Social engineering causes 68% of breaches per Verizon's 2024 DBIR. Learn how it works, common attack types, and how it threatens the software supply chain.
Mar 25, 20266 min read
Open Source
Is the got npm Package Safe? A Security Review of got for Node.js
got is a well-maintained HTTP client, but one redirect-handling CVE and its SSRF-prone defaults are worth knowing before you ship it. Here is the security review.
Mar 25, 20265 min read
Product
Introducing the Safeguard Marketplace: Extend Your Supply Chain Security
The Safeguard Marketplace brings community-built integrations, policy templates, and compliance packs to the platform.
Mar 25, 20265 min read
Tools
Open source dependency scanning (OSS composition risk)
Open source dependency scanning has moved from periodic audits to a CI/CD gate. Here's how it works, where Anchore fits, and where Safeguard differs.
Mar 25, 20268 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.