DevSecOps
Maven Release Plugin Hardening
The Maven Release Plugin is the oldest piece of release automation most Java shops still run. A look at the hardening steps it usually needs.
Mar 13, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCloud Security
What is IAM (Identity and Access Management)
IAM defines who and what can access your systems, and getting it wrong is a root cause behind breaches at Capital One, Toyota, Uber, and CircleCI.
Mar 13, 20268 min read
Best Practices
How to Prevent Dependency Confusion in npm (2026)
Dependency confusion attacks are still landing in 2026 because scoped packages, registry config, and provenance checks are misconfigured by default. Here is the fix.
Mar 13, 20267 min read
DevSecOps
Buck2 (Meta) Build Security Considerations
A security engineer's look at Buck2, Meta's open-source build system, including Starlark sandbox properties, remote execution, and actual supply chain guarantees.
Mar 13, 20267 min read
Threat Intelligence
UNC5221 Ivanti Exploitation Campaign Analysis
UNC5221 chained Ivanti Connect Secure zero-days through 2024 and 2025. The campaign reads like a masterclass in living off trusted edge appliances.
Mar 13, 20267 min read
Product
Safeguard Local Runner: Agentic Security on Your Laptop
The Local Runner is a command-line agent that runs Safeguard workflows against your working tree. Think claude-code-for-security, but for supply chain.
Mar 13, 20267 min read
Regulatory Compliance
ISO 27001 vs NIST CSF: differences and how to choose
ISO 27001 is a certifiable ISMS standard; NIST CSF is a voluntary risk framework. Compare both and see where Safeguard fits vs. Secureframe.
Mar 13, 20268 min read
Incident Analysis
Slack 2022-2023 Incidents: Operational Retrospective
Slack disclosed a stolen-token incident over the 2022 holidays and a related GitHub repository access event; the operational lessons apply broadly.
Mar 13, 20267 min read
Cloud Security
What is the Principle of Least Privilege
The principle of least privilege limits every user and system to only the access it needs. Here's how it works and why it matters for cloud security.
Mar 13, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.