Safeguard on social

A licence change is a supply chain event. Redis 7.2.x and earlier are BSD 3-Clause. Redis 7.4.x to 7.8.x are RSALv2 or SSPLv1. Redis 8 and later are tri-licensed: RSALv2, SSPLv1 or AGPLv3. Valkey continues from Redis 7.2.4 under BSD 3-Clause. Check what your SBOM says about the Redis-compatible server you run. Not legal advice. Release history and licence by version: https://na2.hubs.ly/H08CLVh0

A licence change is a supply chain event. Redis 7.2.x and earlier are BSD 3-Clause. Redis 7.4.x to 7.8.x are RSALv2 or SSPLv1. Redis 8 and later are tri-licensed: RSALv2, SSPLv1 or AGPLv3. Redis's own licence page says SSPLv1 is not an open source licence and AGPLv3 is OSI approved. Valkey continues from Redis 7.2.4 under BSD 3-Clause. The Linux Foundation announced its intent to form it on 28 March 2024. The licence line depends on the project and the version you run. An SBOM that only says "redis" will not tell you which. Check what your SBOM says about the Redis-compatible server you run: which project, which version, which licence. Then check the same for every other component that could change terms between releases. Not legal advice. Your counsel decides what a licence requires of you. Release history, licence by version and the fork: https://lnkd.in/gpxXBbf3 Facts as of 26 Oct 2026, from https://lnkd.in/g7vFKDdr, https://lnkd.in/gucC_dU7 and https://lnkd.in/gxaZfrjf. #SBOM #Redis #Valkey #OpenSource

How does a small team fix many repositories at once? Select the vulnerabilities, run remediation on the selection, and Safeguard batches compatible fixes into one pull request per repository instead of a stream of tiny ones. You review the lot first. The point is not that nobody reads anything. It is that a small team can cover many repositories because only the exceptions need a person. The short answer: https://lnkd.in/g3p6KvhW The full episode: https://lnkd.in/guQJCN_3

How does a small team fix many repositories at once? Select the vulnerabilities, run remediation on the selection, and review one pull request per repository instead of a stream of tiny ones. Quick answer: https://na2.hubs.ly/H08Lk_Y0 Full episode: https://na2.hubs.ly/H08Lk_-0

How does a small team fix many repos at once? Select the vulnerabilities, run remediation on the selection, get one pull request per repo, and review them. Only the exceptions need a person. https://t.co/IQotVrkXPS https://t.co/0qmVO4jyQx

Does an auto-fix run your tests first? With CI connected, your own tests run against the change before the pull request opens. A failing build stays open for a human. A fix is only as well checked as your tests are. Watch the Short on YouTube, link in bio: http://youtube.com/shorts/gwS4W6fc4VE #AppSec #DevSecOps #CI

Does an auto-fix run your tests first? With CI connected, Safeguard can trigger your existing tests against the proposed change before the pull request opens. If they pass, the PR opens with a passing status. If they fail, it stays open for a human, and auto-merge never goes past a failing build. One honest caveat: a fix is only as well checked as your tests are. Green means it builds and passes what you wrote. The short answer: https://lnkd.in/gRVGA4VQ The full episode: https://lnkd.in/gFebRPb4

Does an auto-fix run your tests first? With CI connected, your existing tests run against the proposed change before the pull request opens, and auto-merge never goes past a failing build. Quick answer: https://na2.hubs.ly/H08Lk_h0 Full episode: https://na2.hubs.ly/H08Lk_k0

Does an auto-fix run your tests first? With CI connected, yes: your own tests run against the change before the PR opens. A failing build never gets auto-merged. A fix is only as checked as your tests are. https://t.co/9aThACKdyU https://t.co/LjgOa5C5QC

New on The Audit Window: GDPR for a small SaaS. One data subject request, one month to answer, and the evidence behind it. Link in bio (Spotify, out now).

New episode of The Audit Window: GDPR for a small SaaS. One data subject request, one month to answer, and the evidence a reviewer will ask to see. About 18 minutes. Listen on Spotify: https://na2.hubs.ly/H08Lbhv0

An email lands on a Friday afternoon: send me everything you hold about me, and delete my account. The one month clock has started. What does your company have to show when someone asks how you handled it? The Audit Window, Season 1, Episode 3, "GDPR for a small SaaS: the data subject request and the evidence behind it", follows one request from the received date to the day the answer goes out: who checked identity, which systems were searched, who reviewed the package. It also covers erasure and backups, and what a record of processing is for. Listen on Spotify: https://lnkd.in/gYpfCeNh

On a Friday at ten to five, an email arrives with two lines: send me everything you hold about me, and delete my account. The one month clock started when it landed. Mira and Cal follow that request through a small software company and sit in the reviewer's chair: the received date, who checked identity, which systems were searched, who reviewed the package, and the day the answer went out. They explain the one month deadline in Article 12 and the extension rule, how to confirm who is asking without collecting a passport scan, why logs with IP addresses count, what to do about backups when someone asks for erasure, how to correct data and tell the recipients, what data portability covers, and what a record of processing is for. They also cover the controller and processor question for a company that sells to businesses, and where Safeguard fits on the software evidence side without making anyone compliant. Before that, three stories: the noyb complaints against Scale AI filed on 27 October (allegations, with the company's response), the French regulator's fine against Extia over erasure requests, and the draft EDPB guidelines on fines that are open for comment until 13 November. Theo asks whether your deletion button really deletes, and the episode ends with a checklist for before your window opens. If you run a small software company and need to answer GDPR data subject requests, this episode covers the one month deadline under Article 12, identity checks, the right of access, the right to erasure and backups, rectification, data portability, the record of processing under Article 30, controller and processor roles, and the audit evidence a regulator or customer reviewer asks to see.

About USD 6.3 billion, most of it in about 20 minutes (TRM Labs). That is how fast the Binance theft moved on 29 October. Swipe for what Binance and the FBI have said, what is still unknown, and five checks for developer machines: packages at install time, lockfiles, throwaway VMs for coding tests, short-lived access, and allowlisted hot wallet destinations. Link in bio: http://safeguard.sh/resources/blog (search "Binance") #CyberSecurity #SupplyChainSecurity #DevSecOps #CryptoSecurity

About USD 6.3 billion left Binance on 29 October, most of it in about 20 minutes per TRM Labs. Binance says it may have started with a compromised DevOps engineer's laptop, then found "additional points of breach". On 31 October the FBI named North Korea's TraderTraitor. The full attack path is not public yet, and a post-mortem is pending. What is documented is the playbook: fake recruiters, trojanized coding tests and malicious packages aimed at developers, per CISA, GitHub and the FBI since 2022. That makes the engineer's machine the place to look first. The carousel covers what happened, what Binance and the FBI have said, and a five-point checklist for exchanges and fintechs: check packages at install time, lock dependencies and block install scripts, run coding tests in throwaway VMs, use short-lived access with security keys, and separate duties with allowlisted hot wallet destinations. Safeguard's Package Firewall blocks malicious, typosquatted and dependency-confusion packages at install time for npm and pip. Full breakdown: https://lnkd.in/g3fyPe6R

Should you auto-merge dependency fixes? Safe enough to be a setting. Not safe enough to be the default. In Safeguard a person reviews every fix by default. Auto-merge is opt in, scoped to the repositories, severities or ecosystems you pick, and it only fires after your own CI passes. A failing build leaves the pull request open. A sane rollout: keep everything review required for a few weeks, read the diffs and CI results, then promote one low risk class, like patch level bumps, to auto-merge. The short answer: https://lnkd.in/gK_Zk3ai The full episode: https://lnkd.in/guWyjSh9

About USD 6.3 billion left Binance on 29 October, most of it in about 20 minutes per TRM Labs. Binance says it may have started with a compromised DevOps laptop, and the FBI names North Korea's TraderTraitor. The full attack path is not public yet. Here is what is known and a five-point checklist for developer machines. https://na2.hubs.ly/H08LkX50

Should you auto-merge dependency fixes? Our answer: it should be a setting you turn on, not the default. A person reviews every fix first, and auto-merge only fires after your own tests pass. Short answer here: https://na2.hubs.ly/H08Lk-y0 Full episode: https://na2.hubs.ly/H08LkZG0

Should you auto-merge dependency fixes? Safe enough to be a setting, not safe enough to be the default. Review every fix first, then promote one low risk class to auto-merge once the results earn it. Watch the Short on YouTube, link in bio: http://youtube.com/shorts/HkbxTM6Arfg #AppSec #DevSecOps #SupplyChainSecurity

Auto-merge for dependency fixes: safe enough to be a setting, not safe enough to be the default. Opt in, scoped per repo and severity, and only after your own CI passes. https://t.co/4mcmUGVR8n https://t.co/PQZP0QDADs

Your agent is about to get a new tool. Who wrote it, and what can it touch? Gold Open Source answers the first half in a minute. Look any public MCP server up at https://lnkd.in/g3AX8bkk. It is free and needs no login. The page shows the publisher namespace, the version, whether it is a hosted endpoint or a package you install, the transport, the source repository and a license note. That tells you whose code it is and how it reaches you. A hosted endpoint is someone else's URL. An installable package is their code running on your machine, so it is a dependency: check what it depends on before you install it. What Gold does not show is the tool list or the scopes. Read those yourself in a test client with a throwaway account, then grant the least access you can. The full routine: https://lnkd.in/gYKEjKji #MCP #AIsecurity #AppSec