Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Answer MDS2 items SBOM-1 to SBOM-4 so they match the SBOM you give FDA under section 524B, with support level, end of support and VEX kept per release.
Keep one gate decision record per release: release ID, policy version, findings, decision, approver and time, plus a signed off trail for every exception.
Since OMB M-26-05, agencies set their own proof. Bring a signed SSDF attestation, a current SBOM, build provenance, vulnerability records and a POA&M.
ADAM-3600 EdgeLink firmware before 2.8.5.0 has 30 CVEs, 16 needing no privileges. The only fixed build, 2.8.5.0, is labelled Beta. What to fix first.
Pingora before 0.9.0 let a client's Connection header make a later proxy drop X-Forwarded-For, bypassing IP checks. Who is affected and how to fix it.
CVE-2026-111757: hono's serveStatic decoded paths twice, so requests could skip middleware. Fixed in 4.13.11. The Node.js adapter's GHSA-rmxm-3fg6-px4f has no CVE.
DHS FASCSA Order 2026-01 excludes and removes DeepSeek products from civilian agency IT. What the order says and how suppliers inventory DeepSeek use.
BOOKOFF says 6,427,735 member records (6,383,279 people, 212,371 ex-members) left its system with password hashes. What leaked and what to change now.
Lawson says a third party abused the app mechanism that shows users their own data, exposing 2,155,345 LAWSON ID records. What leaked and what to test.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
