Vulnerability Analysis
What is a Business Logic Vulnerability
Business logic vulnerabilities exploit correct code enforcing the wrong rules. Learn what they are, real breach examples, and how to detect them.
Mar 24, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerabilities
Lodash 4.17.21: The Security History Behind the Version Bump
Lodash 4.17.21 closed a ReDoS path in its number-parsing helpers and a command-injection risk in its templating function — here's the security history that led up to it.
Mar 24, 20265 min read
DevSecOps
How to brew install java 17 on a Mac (Safely)
To brew install Java 17 on a Mac, use the Temurin cask or the openjdk@17 formula, then wire up JAVA_HOME. Here is the full walkthrough plus the security reasons to keep it patched.
Mar 23, 20265 min read
AppSec
Unrestricted File Upload Vulnerabilities: Risks and Fixes
An unrestricted file upload vulnerability lets an attacker place a working web shell on your server through a form that was only ever supposed to accept profile pictures or PDFs.
Mar 23, 20266 min read
AI Security
nullifAI: Broken Pickles and the Hugging Face Detection Gap
ReversingLabs disclosed two malicious Hugging Face models that evaded Picklescan by using broken 7z-packed PyTorch archives. We unpack the technique.
Mar 23, 20266 min read
Compliance
NIST SP 800-218A: SSDF Practices for Generative AI Models
NIST finalized SP 800-218A on July 26, 2024, augmenting the Secure Software Development Framework with practices specific to generative AI and dual-use foundation models.
Mar 23, 20266 min read
Incident Analysis
DeepSeek ClickHouse Exposure: When the AI Vendor Forgets the Database
In January 2025 Wiz Research found a wide-open ClickHouse instance belonging to AI startup DeepSeek, leaking chat history, API keys, and internal log streams. We unpack the AI-supply-chain implications.
Mar 23, 20267 min read
Cloud Security
Cloudflare R2 February 6, 2025 Outage: When Abuse Tooling Took Down Production
A routine phishing-URL takedown clicked the wrong button and disabled R2 globally for 59 minutes. Here is what went wrong and the two-party approval Cloudflare added afterwards.
Mar 23, 20267 min read
Threat Intelligence
AI Deepfake Phishing Campaigns in 2025: When Seeing and Hearing Isn't Believing
AI-generated voice and video deepfakes powered a new wave of phishing campaigns in early 2025. The technology is cheap, the results are convincing, and defenses are lagging.
Mar 23, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.