Open Source Security
Go Module Hijacking Detection
Module hijacking in Go is rare compared to npm, but it does happen, and the patterns worth watching are different from what you might expect from other ecosystems.
Mar 1, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerabilities
CVE-2021-29425: The Commons IO Path Traversal Bug
CVE-2021-29425 shows how a single unhandled case in Apache Commons IO's path normalization let attackers slip past directory checks that assumed a canonicalized path was actually safe.
Mar 1, 20264 min read
Licensing
Open Source Licenses Explained: A Practical Primer
Open source licenses explained for engineers who need to make a compliance call today, not read a legal treatise — permissive, copyleft, and what actually changes your obligations.
Mar 1, 20265 min read
Best Practices
DevEx Meets DevSecOps: Why Developer Experience Determines Security Outcomes
Security tools that developers hate get bypassed. The organizations with the best security outcomes are the ones that treat developer experience as a security requirement.
Mar 1, 20266 min read
Industry Analysis
Clop: Supply Chain Exploitation Tradecraft
Clop has turned supply chain exploitation into a repeatable playbook — MOVEit, GoAnywhere, Cleo. A look at the tradecraft that makes the campaign work.
Mar 1, 20266 min read
DevSecOps
AWS CodePipeline Hardening Patterns
CodePipeline is the glue between your source, build, and deploy. It is also the thing that gets the widest IAM role in most AWS accounts. Here is how to harden it without rewriting your pipelines.
Mar 1, 20267 min read
AI Security
Zero-Day Discovery ROI: CISO Board Deck
How to talk to your board about zero-day discovery without overpromising. The metrics, the framing, and the slides that hold up under follow-up questions.
Mar 1, 20267 min read
Vulnerability Management
SLO-Driven Vulnerability Management Program
Service-level objectives turn vulnerability management from heroics into a measurable program. Here is how to define SLOs that survive contact with reality.
Mar 1, 20268 min read
Industry Analysis
Nation-State Supply Chain Tradecraft Update
Nation-state supply chain tradecraft has evolved sharply since SolarWinds. We trace the 2025 to 2026 patterns, the operational signatures, and defensive implications.
Mar 1, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.