Open Source Security
OpenSSF Scorecard Adoption Metrics: Late 2024
OpenSSF Scorecard crossed 1M scanned repos in October 2024. We break down adoption, score drift, and which checks are actually predictive.
Mar 13, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Analysis
Cisco ASA and FTD CVE-2024-20481: Brute-Force DoS in VPN Services
CVE-2024-20481 in Cisco ASA and Firepower Threat Defense VPN services was actively exploited in large-scale brute-force campaigns, causing denial of service on critical VPN infrastructure.
Mar 13, 20266 min read
Comparisons
CycloneDX vs SPDX in Practice: Choosing an SBOM Format
Both formats are standards, both are mandated somewhere, and your tooling probably emits both. What actually differs when you run CycloneDX and SPDX in production.
Mar 13, 20266 min read
Vulnerability Analysis
FortiJump: CVE-2024-47575 FortiManager Zero-Day Exploited at Scale
CVE-2024-47575, dubbed FortiJump, allowed unauthenticated attackers to execute commands on FortiManager devices. Mandiant confirmed exploitation by a new threat cluster targeting managed Fortinet infrastructure.
Mar 13, 20266 min read
Best Practices
React Native Supply Chain Risks in 2024
React Native bundles native modules, JavaScript dependencies, and CodePush-style OTA updates into one app. The supply chain is vast and the remediation path is slower than web apps. Here is where it actually goes wrong.
Mar 13, 20267 min read
Best Practices
On-Prem to Cloud Supply Chain Continuity
A year inside a financial services cloud migration, and how to keep your software supply chain intact when everything else about the environment changes.
Mar 13, 20268 min read
AI Security
Griffin AI vs GPT-5: Compliance Posture
Compliance posture is about what you can prove, not what you can do. GPT-5 has impressive capabilities; Griffin AI is engineered to be defensible.
Mar 13, 20264 min read
AI Security
Ensemble LLMs For High-Precision Security Findings
One model's confident answer is a guess. Multiple models agreeing is evidence. Ensemble approaches raise precision for security-critical findings.
Mar 13, 20262 min read
Guides
How to Rotate Leaked CI Secrets Without Downtime
A leaked CI credential does not have to mean an outage. The dual-credential pattern: issue new alongside old, cut over, verify with usage logs, then revoke — plus what to do after.
Mar 13, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.