SBOM
SBOM Drift Detection Playbook for 2026
A practical playbook for detecting and responding to SBOM drift between source, build, and runtime, with the patterns that separate signal from noise.
Mar 22, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source
core-js on npm: Security Review and Safe Usage
A security and sustainability review of core-js on npm: the postinstall history, the maintainer funding crisis, and how to keep this near-universal dependency safe.
Mar 22, 20266 min read
AI Security
Griffin AI vs Claude Citations: Advisory Work
Claude's citations feature makes the model say where its claims come from. Griffin AI uses it for advisory workflows where traceability is the entire point.
Mar 22, 20262 min read
AI Security
Regression Gate Design Patterns For Security LLMs
A release gate that fails on regression is the most important operational control for AI-for-security tools. The design patterns are specific and worth copying.
Mar 22, 20262 min read
AI Security
AI Scaffold Prompts: Enterprise Governance
System prompts that scaffold AI assistants are now load-bearing enterprise assets. A framework for versioning, reviewing, and governing them as seriously as source code.
Mar 22, 20268 min read
Security
How Can Malicious Code Do Damage? A Practical Security Guide
Malicious code does damage by abusing the permissions of the process it runs in, then spreading, stealing, or destroying. Here is how each mechanism works and how to blunt it.
Mar 22, 20266 min read
AppSec
Security Testing Automation: What to Automate, and What Not To
Security testing automation pays off fastest on repetitive, well-defined checks — here's a clear line between what to automate and what still needs a human.
Mar 22, 20265 min read
AI Security
Securing MCP Servers: A Practical Checklist
MCP servers are runtime dependencies your agent trusts implicitly. Here is a concrete checklist for auth, tool pinning, sandboxing, and monitoring before you ship one.
Mar 22, 20266 min read
Open Source
connected-react-router: A Security Guide for an Inactive Package
connected-react-router is popular but no longer actively maintained and has no official React 18 support. Here is the risk that creates and how to move off it safely.
Mar 22, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.