Compliance
SOC 2 controls list: what controls you need to implement
A breakdown of the SOC 2 controls list across all five Trust Services Criteria, how Secureframe maps them, and what auditors actually test.
Mar 12, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Analysis
CVE-2025-24071 Windows Explorer NTLM Hash Leak
A .library-ms file extracted from a zip archive can leak NTLM hashes without the user opening anything. Breakdown of CVE-2025-24071 and the defensive response.
Mar 12, 20268 min read
Concepts
What is Dependency Pinning
Dependency pinning locks every package in your build to an exact, verified version so the code you tested is the code you ship. Here's how to do it per ecosystem.
Mar 11, 20266 min read
Concepts
What is an SBOM Drift
SBOM drift is the gap between what your software bill of materials claims and what the artifact actually contains. Here's how it happens and how to detect it with a diff.
Mar 11, 20267 min read
DevSecOps
Docker Hub Rate Limit Changes and CI Impact
Docker's 2024 rate-limit reforms hit CI pipelines hard. Measured impact on 30 real build farms and the mirror and pull-through controls that fixed it.
Mar 11, 20265 min read
Best Practices
GCP Pub/Sub Security Configuration
A working security configuration for GCP Pub/Sub: topic and subscription IAM, message encryption, VPC Service Controls, dead-letter handling, and the failure modes that turn a messaging layer into an attack surface.
Mar 11, 20267 min read
Release
Safeguard v3: Compliance-First Supply Chain Security
Safeguard v3 adds compliance framework mapping, automated evidence collection, audit-ready reporting, and VEX document support for regulatory readiness.
Mar 11, 20266 min read
SBOM
SBOM Adoption in 2024: Enterprise Survey Results and Reality Check
Despite growing regulatory pressure, enterprise SBOM adoption remains uneven. A look at where organizations actually stand with SBOM generation, consumption, and operationalization.
Mar 11, 20266 min read
Industry Analysis
Volt Typhoon: Living-Off-the-Land and Supply Chain
The PRC-linked pre-positioning group that scared DHS and the NSA into a public warning, and what it means for supply chain defenders.
Mar 11, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.