Vulnerability Analysis
GitLab ExifTool RCE (CVE-2021-22205)
CVE-2021-22205 let attackers RCE self-managed GitLab via a malicious ExifTool-parsed upload — no auth required. Here's the timeline and fix.
Jan 11, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCloud Security
Best practices for managing encryption keys with Google C...
A step-by-step guide to Cloud KMS best practices: key hierarchy, IAM scoping, envelope encryption, automated rotation, HSM protection levels, and audit logging.
Jan 11, 20268 min read
Application Security
Secrets Management: Preventing Credential Leaks in Your Software Supply Chain
Hardcoded credentials remain the most common source of breaches. Despite a decade of tooling improvements, secrets keep leaking through source code, container images, CI logs, and dependency configurations. Here is how to actually fix it.
Jan 10, 20269 min read
Dependency Management
Managing End-of-Life Software Dependencies
Every dependency eventually reaches end of life. Here is a practical framework for identifying, tracking, and migrating away from EOL software before it becomes a security liability.
Jan 10, 20267 min read
Dependency Security
Ruby Gems Supply Chain Security
Protecting your Ruby applications from gem-based supply chain attacks with Bundler security features, gem signing, and auditing.
Jan 10, 20264 min read
DevSecOps
ESLint Security Rules Configuration: A Practical Guide
ESLint can catch security issues before they reach production. Here is how to configure security-focused rules that actually help without drowning you in noise.
Jan 10, 20265 min read
DevSecOps
Environment Variable Injection in CI/CD: The Invisible Attack Surface
CI/CD pipelines trust environment variables implicitly. Injecting or modifying them can hijack builds, steal secrets, and compromise deployments.
Jan 10, 20264 min read
Infrastructure Security
Securing Terraform Infrastructure as Code: A Practitioner's Guide
Your Terraform code defines your production infrastructure. If an attacker compromises your HCL files, state files, or provider plugins, they do not just get access — they get the keys to rebuild your entire environment on their terms.
Jan 10, 20268 min read
Risk Management
Building a Supply Chain Risk Appetite Framework
Every organization accepts some supply chain risk. The question is whether that acceptance is deliberate and documented or accidental and invisible.
Jan 10, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.