Container Security
K8s Admission Controllers for Supply Chain Policy
How to design Kubernetes admission controllers that enforce supply chain policy without turning every deploy into a 30-minute argument with the cluster.
Jan 13, 20266 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
How to design Kubernetes admission controllers that enforce supply chain policy without turning every deploy into a 30-minute argument with the cluster.
CVE-2024-38856 is an unauthenticated RCE in Apache OFBiz that bypasses authentication via screen rendering. Exploit chain, detection, and patching.
Two AI bug hunters can both generate hypotheses. Only one can defend them. A field study of grounded versus ungrounded hypothesis generation in zero-day discovery.
Where zk-SNARKs, STARKs, and Bulletproofs actually fit in software supply chain attestation, and where conventional signatures remain the correct choice.
AI models ship with dependencies, use vulnerable libraries, and introduce novel attack surfaces. Traditional scanning is not enough.
A full recap of Q4 2025 at Safeguard.sh: Griffin for Java and .NET, Eagle attestations, Lino serverless, Gold policy-aware remediation, and more.
Claude Code MCP servers run with the privileges of the developer who invoked them. That makes deployment posture the entire security model.
XML's feature richness is its security weakness. XXE, entity expansion, and XSLT injection continue to plague applications that process XML.
Safeguard.sh is in early-stage discussions with Tech-D Cybersecurity Ltd to explore co-selling, joint delivery, and shared services opportunities.
Weekly insights on software supply chain security, delivered to your inbox.