Safeguard on social

WYSIWYG is over. Agents now pick your packages, models and skills per task, so no two builds share a supply chain. Our new post covers the eight controls that follow each build. Link in bio: safeguard.sh/resources/blog/from-wysiwyg-to-wygiwyn-what-you-get-is-what-you-need

Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision. In Safeguard you pick the model: Claude or GPT models through your own vendor account, Safeguard's own models, or one you host behind an OpenAI-compatible, Anthropic Messages or Gemini API. Then you pick where it runs: SaaS in the US, EU (Frankfurt) or Gov, a private VPC, on-prem, or air-gapped with Safeguard's models inside. Honest note: closed models from Anthropic, OpenAI, Google and xAI never run on-prem or air-gapped, so air-gapped means Safeguard's or open-weight models. Your model, your call (2 of 3). Link in bio: http://safeguard.sh/resources/blog Claude is a product of Anthropic. ChatGPT is a product of OpenAI. #appsec #supplychainsecurity #dataresidency #cybersecurity #devsecops

Most security tools stall when the twentieth team needs access. The fix is order: pilot one team, put SSO, multi-factor and roles in first, run policies in Warn or Notify, then switch the gates that matter to Block. SAML or OIDC sign-in, SCIM deprovisioning, scoped roles, an org hierarchy and an audit log you can stream to your SIEM. Link in bio: http://safeguard.sh/resources/blog/roll-out-safeguard-across-an-enterprise-sso-scim-roles-org-hierarchy-and-audit-log #SSO #SCIM #AppSec #DevSecOps

A skill is a folder, not a prompt. The description loads first, the scripts run later, and nobody reads them in between. Our new guide shows how to write and test a http://SKILL.md, then the eight risks and a control for each. Link in bio: safeguard.sh/resources/blog/how-to-write-and-secure-agent-skills-skill-md-authoring-testing-permissions-and-supply-chain-controls

Every MCP server you connect is code running with your credentials. Our new guide covers the OWASP MCP Top 10, the lethal trifecta, and a fix for each of the ten risks, from tool poisoning to shadow servers. Link in bio: safeguard.sh/resources/blog/what-is-an-mcp-server-and-how-to-secure-it-owasp-mcp-top-10-explained

XXE is mostly a settings problem. Every new SAML handler, SVG preview or SOAP client is a chance to ship a parser with defaults that allow DTDs. Our new post gives you the settings for 7 languages, three CI checks including a DOCTYPE negative test, and the library versions that fix known XXE bugs. Link in bio: safeguard.sh/resources/blog/stop-xxe-before-merge-parser-settings-ci-checks-and-upgrades

A new blocking rule that breaks every build gets switched off. Start it as a warn: the gate passes and names the policy. Fix what it finds, flip the same rule to Block, and let CI fail the build on a failed gate. Link in bio: http://safeguard.sh/resources/blog #devsecops #appsec #supplychainsecurity #cicd

"We will fix it later" only holds up if someone decided it, wrote down why, and set an end date. Our new post covers the four mitigation types in Safeguard, expiry presets of 30, 90, 180 and 365 days, reminders before it lapses, and the history that serves as your audit trail. Expired means the finding counts again. Link in bio: safeguard.sh/resources/blog/document-a-vulnerability-mitigation-in-safeguard-risk-acceptance-expiry-review-and-audit-trail

Anthropic filed an S-1 on 26 October 2026. If your team depends on Claude, use it to sharpen your AI vendor questionnaire. Swipe for the questions by group: data retention, supply chain, agents and connectors, availability, incidents. All 14 are in the post. Not investment advice. Link in bio: http://safeguard.sh/resources/blog/anthropic-s-1-ai-vendor-risk-security-teams #AISecurity #VendorRisk #ThirdPartyRisk #AppSec

Safeguard Desktop 3.3.0 is out. Electron 45, an encrypted saved sign-in, a sandboxed Linux AppImage. Mac builds are signed and notarized, and SHA-256 checksums are listed for every installer. Download: http://safeguard.sh/download (link in bio) #appsec #devsecops #supplychainsecurity

How does a small team fix many repositories at once? Select, run remediation, review one pull request per repository. Only the exceptions need a person. Watch the Short on YouTube, link in bio: http://youtube.com/shorts/ORIvrX0x1LI #AppSec #DevSecOps #SupplyChainSecurity

A licence change is a supply chain event. Redis 7.2.x and earlier: BSD 3-Clause. Redis 7.4.x to 7.8.x: RSALv2 or SSPLv1. Redis 8 and later: RSALv2, SSPLv1 or AGPLv3. Valkey continues from Redis 7.2.4 under BSD 3-Clause. Check what your SBOM says about the Redis-compatible server you run. Not legal advice. Link in bio: http://safeguard.sh/resources/blog/redis-and-valkey-release-history-from-2009-to-redis-8-and-valkey-8-licence-changes-the-fork-and-security-defaults #SBOM #Redis #Valkey #OpenSource

Does an auto-fix run your tests first? With CI connected, your own tests run against the change before the pull request opens. A failing build stays open for a human. A fix is only as well checked as your tests are. Watch the Short on YouTube, link in bio: http://youtube.com/shorts/gwS4W6fc4VE #AppSec #DevSecOps #CI

New on The Audit Window: GDPR for a small SaaS. One data subject request, one month to answer, and the evidence behind it. Link in bio (Spotify, out now).

About USD 6.3 billion, most of it in about 20 minutes (TRM Labs). That is how fast the Binance theft moved on 29 October. Swipe for what Binance and the FBI have said, what is still unknown, and five checks for developer machines: packages at install time, lockfiles, throwaway VMs for coding tests, short-lived access, and allowlisted hot wallet destinations. Link in bio: http://safeguard.sh/resources/blog (search "Binance") #CyberSecurity #SupplyChainSecurity #DevSecOps #CryptoSecurity

Should you auto-merge dependency fixes? Safe enough to be a setting, not safe enough to be the default. Review every fix first, then promote one low risk class to auto-merge once the results earn it. Watch the Short on YouTube, link in bio: http://youtube.com/shorts/HkbxTM6Arfg #AppSec #DevSecOps #SupplyChainSecurity

Your agent is about to get a new tool. Who wrote it, and what can it touch? Look the MCP server up on Gold Open Source first. Free, no login. You see the publisher namespace, the version, hosted endpoint or installable package, and the source repo. A package means their code runs on your machine, so check what it depends on. Gold does not list tools or scopes, so read those in a test client. Full routine: link in bio, http://safeguard.sh/resources/blog #MCP #AIsecurity #AppSec #DevSecOps

Safeguard is now listed among SCA tools on OWASP's Component Analysis page. It is a line in a table, not an endorsement. OWASP says it does not endorse commercial products. The page is still a useful checklist. Our post turns it into a test plan for any SCA tool: inventory, transitive paths, SBOM, VEX and time to a merged fix. Link in bio: safeguard.sh/resources/blog/safeguard-listed-in-owasp-component-analysis-what-sca-tools-do-and-how-to-evaluate-them

Five scanners, five inboxes, one vulnerable library reported three times. Safeguard puts SCA, SAST, DAST, container and IaC findings in one queue, merges duplicates, ranks them with KEV, EPSS and static reachability, and routes each to an owner. Findings it cannot decide on are never suppressed. Link in bio: http://safeguard.sh/resources/blog/one-findings-queue-in-safeguard-unified-findings-autotriage-reachability-and-ownership #AppSec #VulnerabilityManagement #SupplyChainSecurity

The image you are about to push. Has anything checked it yet? A scan in a separate job pulls from a registry, so the image is already pushed. Scan in the build job instead: the Safeguard CLI reads the local image and checks OS packages, the base image and app dependencies. Only results leave the runner. Fail the step on a severity, push only what passed, scan again at deploy. Guide: link in bio (http://safeguard.sh/resources/blog) People footage: Mixkit stock. #DevSecOps #ContainerSecurity #AppSec #Docker

A yearly questionnaire is a snapshot. Tier your vendors by criticality, ask for SBOMs on a cadence per tier, read a 0 to 100 risk score and get alerts when something changes. Safeguard's Third Party Risk Manager walks the whole loop, from vendor register to renewal decision. Link in bio: http://safeguard.sh/resources/blog/tier-your-software-vendors-in-safeguard-tprm-risk-score-sbom-requests-and-continuous-monitoring #ThirdPartyRisk #TPRM #SBOM #SupplyChainSecurity

Self-hosted GitLab? CVE-2026-97229 is a CVSS 10.0 CI regex flaw. It is fixed in 19.4.2, 19.3.5 and 19.2.8, and the real fix lives in the Ruby underneath. Check both versions, upgrade, then review CI runner exposure. Link in bio: http://safeguard.sh/resources/blog/gitlab-cve-2026-97229-ci-regex-flaw-patch-self-hosted-gitlab-and-check-runner-exposure #GitLab #CVE #DevSecOps #SupplyChainSecurity

Is there GPL code in this OTA image? Answer it from an inventory with a license on every line, not from memory. Swipe for the routine: one inventory per release version, SPDX identifiers, a policy set before the release, exceptions with an approver and an expiry date, and the record kept with the release. Not legal advice. Counsel decides what a license requires of your product. Link in bio: http://safeguard.sh/resources/blog/use-case-license-compliance-before-shipping-firmware-in-automotive #OpenSourceCompliance #SBOM #Automotive #FirmwareSecurity

PostgreSQL 14 gets its final release on 12 November. After that, new bugs get fixed in newer versions only. Find every 14: the main cluster, CI containers, migration jobs, replicas, vendor appliances. Apply the final release, then plan the move to 18. Link in bio: http://safeguard.sh/resources/blog Video: Malcolm McLean, PostgresConf South Africa 2018, CC BY 4.0. Stock: Mixkit. #postgresql #devops #platformengineering #database