{"items":[{"id":"facebook-102234939991","network":"facebook","url":"https://www.facebook.com/122095740945423737/posts/122126059803423737","text":"Software used to be WYSIWYG: what you see is what you get. With coding agents building every app to order, it is WYGIWYN: what you get is what you need. And no two builds share a supply chain. Here is what security has to do about it: https://na2.hubs.ly/H08Lt-b0","full_text":"Software used to be WYSIWYG: what you see is what you get. With coding agents building every app to order, it is WYGIWYN: what you get is what you need. And no two builds share a supply chain. Here is what security has to do about it:\nhttps://na2.hubs.ly/H08Lt-b0","image":"https://safeguard.sh/social/f7af3d314617.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T12:00:14.000Z","related_blog_url":"https://safeguard.sh/resources/blog/from-wysiwyg-to-wygiwyn-what-you-get-is-what-you-need"},{"id":"linkedin-102234940249","network":"linkedin","url":"https://www.linkedin.com/feed/update/urn:li:share:7522990933299187712","text":"For thirty years software was WYSIWYG: what you see is what you get. Millions of teams ran the same release of the same package, so one advisory protected everyone at once. Coding agents break that. They pick the packages, the model, the skills and the connectors for each task,…","full_text":"For thirty years software was WYSIWYG: what you see is what you get. Millions of teams ran the same release of the same package, so one advisory protected everyone at once.\n\nCoding agents break that. They pick the packages, the model, the skills and the connectors for each task, so two teams asking for the same service get different trees and different call paths. \"Known good\" stops being something we share.\n\nOur new post argues the unit of security becomes the build: an SBOM and AI-BOM per build, verifiable provenance, static reachability, a policy gate in CI, a package firewall in front of installs, explicit agent permission modes, and fixes that arrive as pull requests your own CI tests.\n\nWYGIWYN: what you get is what you need.\nhttps://lnkd.in/g5DMxEpG","image":"https://safeguard.sh/social/f7af3d314617.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T12:00:09.081Z","related_blog_url":"https://safeguard.sh/resources/blog/from-wysiwyg-to-wygiwyn-what-you-get-is-what-you-need"},{"id":"instagram-102234939958","network":"instagram","url":"https://www.instagram.com/p/DfPQa-5AT7W/","text":"WYSIWYG is over. Agents now pick your packages, models and skills per task, so no two builds share a supply chain. Our new post covers the eight controls that follow each build. Link in bio: safeguard.sh/resources/blog/from-wysiwyg-to-wygiwyn-what-you-get-is-what-you-need","full_text":"WYSIWYG is over. Agents now pick your packages, models and skills per task, so no two builds share a supply chain.\n\nOur new post covers the eight controls that follow each build.\n\nLink in bio: safeguard.sh/resources/blog/from-wysiwyg-to-wygiwyn-what-you-get-is-what-you-need","image":"https://safeguard.sh/social/f7af3d314617.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T12:00:06.000Z","related_blog_url":null},{"id":"x-102234939929","network":"x","url":"https://twitter.com/safeguard_sh/status/2117225209707278624","text":"WYSIWYG gave security sameness: one advisory, one patch, everyone covered. Agents build every app to order now (WYGIWYN), so the build is the unit to secure. Eight controls that hold up. https://t.co/eNcCLLAYEl https://t.co/yWvX1SFOfo","full_text":"WYSIWYG gave security sameness: one advisory, one patch, everyone covered. Agents build every app to order now (WYGIWYN), so the build is the unit to secure. Eight controls that hold up. https://t.co/eNcCLLAYEl https://t.co/yWvX1SFOfo","image":"https://safeguard.sh/social/f7af3d314617.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T12:00:00.000Z","related_blog_url":"https://safeguard.sh/resources/blog/from-wysiwyg-to-wygiwyn-what-you-get-is-what-you-need"},{"id":"instagram-102234939004","network":"instagram","url":"https://www.instagram.com/reel/DfPJj9xDGVo/","text":"Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision. In Safeguard you pick the model: Claude or GPT models through your own vendor account, Safeguard's own models, or one you host behind an OpenAI-compa…","full_text":"Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision.\n\nIn Safeguard you pick the model: Claude or GPT models through your own vendor account, Safeguard's own models, or one you host behind an OpenAI-compatible, Anthropic Messages or Gemini API. Then you pick where it runs: SaaS in the US, EU (Frankfurt) or Gov, a private VPC, on-prem, or air-gapped with Safeguard's models inside.\n\nHonest note: closed models from Anthropic, OpenAI, Google and xAI never run on-prem or air-gapped, so air-gapped means Safeguard's or open-weight models.\n\nYour model, your call (2 of 3).\n\nLink in bio: http://safeguard.sh/resources/blog\n\nClaude is a product of Anthropic. ChatGPT is a product of OpenAI.\n\n#appsec #supplychainsecurity #dataresidency #cybersecurity #devsecops","image":"https://safeguard.sh/social/0547d3a4f449.webp","media":"video","image_w":640,"image_h":1137,"published_at":"2026-11-02T11:02:22.000Z","related_blog_url":null},{"id":"instagram-102234938998","network":"instagram","url":"https://www.instagram.com/p/DfPJjlQgbU6/","text":"Most security tools stall when the twentieth team needs access. The fix is order: pilot one team, put SSO, multi-factor and roles in first, run policies in Warn or Notify, then switch the gates that matter to Block. SAML or OIDC sign-in, SCIM deprovisioning, scoped roles, an org…","full_text":"Most security tools stall when the twentieth team needs access. The fix is order: pilot one team, put SSO, multi-factor and roles in first, run policies in Warn or Notify, then switch the gates that matter to Block.\n\nSAML or OIDC sign-in, SCIM deprovisioning, scoped roles, an org hierarchy and an audit log you can stream to your SIEM.\n\nLink in bio: http://safeguard.sh/resources/blog/roll-out-safeguard-across-an-enterprise-sso-scim-roles-org-hierarchy-and-audit-log\n\n#SSO #SCIM #AppSec #DevSecOps","image":"https://safeguard.sh/social/ed3929e6c61f.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T11:02:06.000Z","related_blog_url":"https://safeguard.sh/resources/blog/roll-out-safeguard-across-an-enterprise-sso-scim-roles-org-hierarchy-and-audit-log"},{"id":"linkedin-102234938999","network":"linkedin","url":"https://www.linkedin.com/feed/update/urn:li:ugcPost:7522976312899092480","text":"Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision. In Safeguard you make both halves of that call. The model. Claude or GPT models through your own vendor account, Safeguard's own models, a self-hoste…","full_text":"Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision.\n\nIn Safeguard you make both halves of that call.\n\nThe model. Claude or GPT models through your own vendor account, Safeguard's own models, a self-hosted or open-weight model, or one you built behind an OpenAI-compatible, Anthropic Messages or Gemini API. An admin adds it under Integrations, Configure Scanner, Models, the key stays in the credential vault, and \"Route jobs to this model\" sends Safeguard's AI features, such as search and chat, to it.\n\nThe deployment. Safeguard SaaS in the US, EU (Frankfurt) or Gov region, a private VPC, on-prem, or air-gapped with Safeguard's own models included.\n\nOne honest note. Closed models from Anthropic, OpenAI, Google and xAI never run on-prem or air-gapped, so air-gapped means Safeguard's or open-weight models. And with Safeguard SaaS, a self-hosted endpoint has to be reachable from Safeguard.\n\nYour model, your deployment, your call. (2 of 3 in the series \"Your model, your call\")\n\nWhere your code and data go: https://lnkd.in/gnwZMkP4\n\nClaude is a product of Anthropic. ChatGPT is a product of OpenAI.\n\n#AppSec #SupplyChainSecurity #DataResidency #CISO","image":"https://safeguard.sh/social/14c32cf20770.webp","media":"video","image_w":640,"image_h":640,"published_at":"2026-11-02T11:02:03.344Z","related_blog_url":"https://safeguard.sh/resources/blog/where-your-code-and-data-go-with-safeguard-saas-regions-private-vpc-on-prem-and-air-gapped"},{"id":"facebook-102234938976","network":"facebook","url":"https://www.facebook.com/reel/1880703323348414/","text":"Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision. With Safeguard you pick the model (Claude or GPT models through your own vendor account, Safeguard's own models, or one you host behind an OpenAI-com…","full_text":"Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision.\n\nWith Safeguard you pick the model (Claude or GPT models through your own vendor account, Safeguard's own models, or one you host behind an OpenAI-compatible, Anthropic Messages or Gemini API) and where it runs (SaaS in the US, EU (Frankfurt) or Gov, a private VPC, on-prem, or air-gapped with Safeguard's models inside).\n\nHonest note: closed models from Anthropic, OpenAI, Google and xAI never run on-prem or air-gapped, so air-gapped means Safeguard's or open-weight models, and a self-hosted endpoint must be reachable from Safeguard SaaS.\n\nYour model, your call (2/3). Where your code and data go: https://na2.hubs.ly/H08FzbF0\n\nClaude is a product of Anthropic. ChatGPT is a product of OpenAI.","image":"https://safeguard.sh/social/14c32cf20770.webp","media":"video","image_w":640,"image_h":640,"published_at":"2026-11-02T11:00:50.000Z","related_blog_url":"https://safeguard.sh/resources/blog/where-your-code-and-data-go-with-safeguard-saas-regions-private-vpc-on-prem-and-air-gapped"},{"id":"youtube-102234938967","network":"youtube","url":"https://www.youtube.com/watch?v=B5of9BTXH7s","text":"Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision. In Safeguard you pick the model (Claude or GPT models through your own vendor account, Safeguard's own models, or one you host behind an OpenAI-compa…","full_text":"Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, where your code and prompts go should be your decision. In Safeguard you pick the model (Claude or GPT models through your own vendor account, Safeguard's own models, or one you host behind an OpenAI-compatible, Anthropic Messages or Gemini API) and where it runs (SaaS in the US, EU (Frankfurt) or Gov, a private VPC, on-prem, or air-gapped with Safeguard's models inside). Honest note: closed models from Anthropic, OpenAI, Google and xAI never run on-prem or air-gapped, so air-gapped means Safeguard's or open-weight models, and a self-hosted endpoint must be reachable from Safeguard SaaS.\n\nWhere your code and data go: https://na2.hubs.ly/H08FzbG0\n\nClaude is a product of Anthropic. ChatGPT is a product of OpenAI.\nStock footage: Mixkit (Mixkit Stock Video Free License). Product footage: Safeguard docs, recorded read-only.\n\n#appsec #supplychainsecurity #dataresidency","image":"https://safeguard.sh/social/91f94d401b4b.webp","media":"video","image_w":640,"image_h":480,"published_at":"2026-11-02T11:00:29.000Z","related_blog_url":"https://safeguard.sh/resources/blog/where-your-code-and-data-go-with-safeguard-saas-regions-private-vpc-on-prem-and-air-gapped"},{"id":"facebook-102234938952","network":"facebook","url":"https://www.facebook.com/122095740945423737/posts/122126052777423737","text":"Most security tools stall when the twentieth team needs access. Our rollout order: pilot one team, put SSO, multi-factor and roles in first, run policies in Warn or Notify, then switch the gates that matter to Block. SAML or OIDC sign-in, SCIM deprovisioning, scoped roles, an or…","full_text":"Most security tools stall when the twentieth team needs access. Our rollout order: pilot one team, put SSO, multi-factor and roles in first, run policies in Warn or Notify, then switch the gates that matter to Block.\n\nSAML or OIDC sign-in, SCIM deprovisioning, scoped roles, an org hierarchy and an audit log you can stream to your SIEM:\nhttps://na2.hubs.ly/H08J5jW0","image":"https://safeguard.sh/social/ed3929e6c61f.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T11:00:14.000Z","related_blog_url":"https://safeguard.sh/resources/blog/roll-out-safeguard-across-an-enterprise-sso-scim-roles-org-hierarchy-and-audit-log"},{"id":"linkedin-102234938959","network":"linkedin","url":"https://www.linkedin.com/feed/update/urn:li:share:7522975833456832513","text":"Most security tools stall after the first enthusiastic team, when the twentieth team needs access. The blockers are about identity and control, not scanning. A rollout order that works: pilot one team, put SSO, multi-factor and roles in first, run policies in Warn or Notify, the…","full_text":"Most security tools stall after the first enthusiastic team, when the twentieth team needs access. The blockers are about identity and control, not scanning.\n\nA rollout order that works: pilot one team, put SSO, multi-factor and roles in first, run policies in Warn or Notify, then switch the gates that matter to Block.\n\nThe pieces it leans on: SAML 2.0 or OpenID Connect sign-in, SCIM 2.0 deprovisioning, built-in and custom roles scoped to an organization or team, a tenant and organization hierarchy, and an append-only audit log you can stream to your SIEM.\n\nThe full guide for the AppSec or platform owner running the rollout and the identity architect signing it off:\nhttps://lnkd.in/gnwzBv5A\n\n#SSO #SCIM #AppSec #DevSecOps","image":"https://safeguard.sh/social/ed3929e6c61f.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T11:00:09.040Z","related_blog_url":"https://safeguard.sh/resources/blog/roll-out-safeguard-across-an-enterprise-sso-scim-roles-org-hierarchy-and-audit-log"},{"id":"x-102234938947","network":"x","url":"https://twitter.com/safeguard_sh/status/2117210140659372040","text":"Standardised on Anthropic's Claude or OpenAI's ChatGPT? Where your code and prompts go is still your call. Bring your model. Pick where Safeguard runs, SaaS to air-gapped. Air-gapped means Safeguard's or open-weight models. Your model, your call (2/3) https://t.co/w0G95ogBnr htt…","full_text":"Standardised on Anthropic's Claude or OpenAI's ChatGPT? Where your code and prompts go is still your call.\n\nBring your model. Pick where Safeguard runs, SaaS to air-gapped. Air-gapped means Safeguard's or open-weight models.\n\nYour model, your call (2/3)\nhttps://t.co/w0G95ogBnr https://t.co/QyvQcaaz7k","image":"https://safeguard.sh/social/14c32cf20770.webp","media":"video","image_w":640,"image_h":640,"published_at":"2026-11-02T11:00:08.000Z","related_blog_url":"https://safeguard.sh/resources/blog/where-your-code-and-data-go-with-safeguard-saas-regions-private-vpc-on-prem-and-air-gapped"},{"id":"x-102234938946","network":"x","url":"https://twitter.com/safeguard_sh/status/2117210110422643083","text":"Security tools stall when the 20th team needs access. Rollout order: pilot one team, SSO + MFA + roles first, policies in Warn, then Block the gates that matter. https://t.co/5bmgr3kV8j https://t.co/HhdHlNvmYt","full_text":"Security tools stall when the 20th team needs access. Rollout order: pilot one team, SSO + MFA + roles first, policies in Warn, then Block the gates that matter. https://t.co/5bmgr3kV8j https://t.co/HhdHlNvmYt","image":"https://safeguard.sh/social/ed3929e6c61f.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T11:00:00.000Z","related_blog_url":"https://safeguard.sh/resources/blog/roll-out-safeguard-across-an-enterprise-sso-scim-roles-org-hierarchy-and-audit-log"},{"id":"tiktok-102234938968","network":"tiktok","url":"https://www.tiktok.com/@safeguard_sh/video/7703527255472966944","text":"On Claude or ChatGPT? Where your code goes is still your call. Bring your model, pick where Safeguard runs: US, EU (Frankfurt), Gov, VPC, on-prem, air-gapped. Closed models never run on-prem or air-gapped, so air-gapped = Safeguard's or open-weight models. Your model, your call…","full_text":"On Claude or ChatGPT? Where your code goes is still your call. Bring your model, pick where Safeguard runs: US, EU (Frankfurt), Gov, VPC, on-prem, air-gapped. Closed models never run on-prem or air-gapped, so air-gapped = Safeguard's or open-weight models. Your model, your call 2/3. Claude is a product of Anthropic. ChatGPT is a product of OpenAI. #appsec #supplychainsecurity #dataresidency","image":"https://safeguard.sh/social/0547d3a4f449.webp","media":"video","image_w":640,"image_h":1137,"published_at":"2026-11-02T11:00:00.000Z","related_blog_url":null},{"id":"instagram-102234937356","network":"instagram","url":"https://www.instagram.com/p/DfPCsHQAd8M/","text":"A skill is a folder, not a prompt. The description loads first, the scripts run later, and nobody reads them in between. Our new guide shows how to write and test a http://SKILL.md, then the eight risks and a control for each. Link in bio: safeguard.sh/resources/blog/how-to-writ…","full_text":"A skill is a folder, not a prompt. The description loads first, the scripts run later, and nobody reads them in between.\n\nOur new guide shows how to write and test a http://SKILL.md, then the eight risks and a control for each.\n\nLink in bio: safeguard.sh/resources/blog/how-to-write-and-secure-agent-skills-skill-md-authoring-testing-permissions-and-supply-chain-controls","image":"https://safeguard.sh/social/78a94f6e7fe5.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T10:02:06.000Z","related_blog_url":null},{"id":"linkedin-102234937348","network":"linkedin","url":"https://www.linkedin.com/feed/update/urn:li:share:7522960725334482944","text":"Writing an Agent Skill takes ten minutes. Writing one that triggers on the right requests and does not hand an attacker your shell takes real engineering. A skill is a folder with a https://lnkd.in/gZ44vq46, loaded in stages: the description first, the body when a task matches,…","full_text":"Writing an Agent Skill takes ten minutes. Writing one that triggers on the right requests and does not hand an attacker your shell takes real engineering.\n\nA skill is a folder with a https://lnkd.in/gZ44vq46, loaded in stages: the description first, the body when a task matches, bundled files only when the instructions call for them. That is why the parts that run are the parts nobody reads until they run.\n\nOur new guide goes field by field through the format, shows how to write and test a skill so the description triggers it, then takes apart eight risks with a control for each: trojaned scripts, injected instructions, broad allowed tools, inline shell, secrets, impersonated marketplaces, runtime installs and silent updates.\nhttps://lnkd.in/gjnyYWBk","image":"https://safeguard.sh/social/78a94f6e7fe5.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T10:00:06.991Z","related_blog_url":null},{"id":"facebook-102234937347","network":"facebook","url":"https://www.facebook.com/122095740945423737/posts/122126046465423737","text":"Agent Skills are easy to write and easy to under review. Here is how to write a https://na2.hubs.ly/H08LsLS0 that triggers correctly, and the eight risks to check before you install or share one: https://na2.hubs.ly/H08LsLV0","full_text":"Agent Skills are easy to write and easy to under review. Here is how to write a https://na2.hubs.ly/H08LsLS0 that triggers correctly, and the eight risks to check before you install or share one:\nhttps://na2.hubs.ly/H08LsLV0","image":"https://safeguard.sh/social/78a94f6e7fe5.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T10:00:05.000Z","related_blog_url":null},{"id":"x-102234937346","network":"x","url":"https://twitter.com/safeguard_sh/status/2117195012324942263","text":"A skill's description is its trigger, and its scripts are what runs. How to write a https://t.co/1a4Pb2NCYj that loads when it should, plus 8 risks with a control for each, from trojaned scripts to silent updates. https://t.co/vJ23xsHpAa https://t.co/5vM2QFFDXZ","full_text":"A skill's description is its trigger, and its scripts are what runs. How to write a https://t.co/1a4Pb2NCYj that loads when it should, plus 8 risks with a control for each, from trojaned scripts to silent updates. https://t.co/vJ23xsHpAa https://t.co/5vM2QFFDXZ","image":"https://safeguard.sh/social/78a94f6e7fe5.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T10:00:01.000Z","related_blog_url":null},{"id":"instagram-102234935883","network":"instagram","url":"https://www.instagram.com/p/DfO70nCAYOq/","text":"Every MCP server you connect is code running with your credentials. Our new guide covers the OWASP MCP Top 10, the lethal trifecta, and a fix for each of the ten risks, from tool poisoning to shadow servers. Link in bio: safeguard.sh/resources/blog/what-is-an-mcp-server-and-how-…","full_text":"Every MCP server you connect is code running with your credentials.\n\nOur new guide covers the OWASP MCP Top 10, the lethal trifecta, and a fix for each of the ten risks, from tool poisoning to shadow servers.\n\nLink in bio: safeguard.sh/resources/blog/what-is-an-mcp-server-and-how-to-secure-it-owasp-mcp-top-10-explained","image":"https://safeguard.sh/social/a52dfd9cd6e2.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T09:02:05.000Z","related_blog_url":null},{"id":"facebook-102234935852","network":"facebook","url":"https://www.facebook.com/122095740945423737/posts/122126034075423737","text":"Which MCP servers are your AI assistants connected to, and who approved them? The OWASP MCP Top 10 explained in plain terms, with a fix for every risk, from leaked tokens to shadow servers: https://na2.hubs.ly/H08LsLc0","full_text":"Which MCP servers are your AI assistants connected to, and who approved them?\n\nThe OWASP MCP Top 10 explained in plain terms, with a fix for every risk, from leaked tokens to shadow servers:\nhttps://na2.hubs.ly/H08LsLc0","image":"https://safeguard.sh/social/a52dfd9cd6e2.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T09:00:18.000Z","related_blog_url":"https://safeguard.sh/resources/blog/what-is-an-mcp-server-and-how-to-secure-it-owasp-mcp-top-10-explained"},{"id":"linkedin-102234935857","network":"linkedin","url":"https://www.linkedin.com/feed/update/urn:li:share:7522945634266488832","text":"An MCP server is code you run with your credentials. Most teams approve one and never look again. On 25 September 2025 Postmark said someone had impersonated it with an npm package called postmark-mcp. After 15 clean versions, 1.0.16 quietly blind copied every email the tool sen…","full_text":"An MCP server is code you run with your credentials. Most teams approve one and never look again.\n\nOn 25 September 2025 Postmark said someone had impersonated it with an npm package called postmark-mcp. After 15 clean versions, 1.0.16 quietly blind copied every email the tool sent to an outside address. Nothing in the tool description changed, so neither the model nor the user could see it.\n\nOur new guide explains MCP at the wire level, then the lethal trifecta (private data, untrusted content and a way out), then all ten OWASP MCP Top 10 risks with a concrete fix for each, from token leaks and tool poisoning to shadow servers. It also notes the OWASP list is still in beta, so treat it as an evolving reference.\nhttps://lnkd.in/g3C4rGKk","image":"https://safeguard.sh/social/a52dfd9cd6e2.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T09:00:09.111Z","related_blog_url":"https://safeguard.sh/resources/blog/what-is-an-mcp-server-and-how-to-secure-it-owasp-mcp-top-10-explained"},{"id":"x-102234935848","network":"x","url":"https://twitter.com/safeguard_sh/status/2117179910779482296","text":"An MCP server is a program with your credentials. The lethal trifecta: private data + untrusted content + a way out. Then all 10 OWASP MCP risks, each with a fix. Includes the postmark-mcp backdoor that BCC'd every email. https://t.co/xcKcG1OElw https://t.co/i5qS5vii0U","full_text":"An MCP server is a program with your credentials. The lethal trifecta: private data + untrusted content + a way out. Then all 10 OWASP MCP risks, each with a fix. Includes the postmark-mcp backdoor that BCC'd every email. https://t.co/xcKcG1OElw https://t.co/i5qS5vii0U","image":"https://safeguard.sh/social/a52dfd9cd6e2.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T09:00:00.000Z","related_blog_url":"https://safeguard.sh/resources/blog/what-is-an-mcp-server-and-how-to-secure-it-owasp-mcp-top-10-explained"},{"id":"facebook-102234935433","network":"facebook","url":"https://www.facebook.com/122095740945423737/posts/122126030979423737","text":"Fixed an XXE finding and it came back? A new parser with default settings probably shipped in a new place. Parser settings for Java, .NET, Python, PHP, Go, http://Node.js and Ruby, plus the CI checks that stop an unsafe parser from merging: https://na2.hubs.ly/H08Lrsc0","full_text":"Fixed an XXE finding and it came back? A new parser with default settings probably shipped in a new place.\n\nParser settings for Java, .NET, Python, PHP, Go, http://Node.js and Ruby, plus the CI checks that stop an unsafe parser from merging:\nhttps://na2.hubs.ly/H08Lrsc0","image":"https://safeguard.sh/social/f385ccf0049f.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T08:30:19.000Z","related_blog_url":"https://safeguard.sh/resources/blog/stop-xxe-before-merge-parser-settings-ci-checks-and-upgrades"},{"id":"linkedin-102234935439","network":"linkedin","url":"https://www.linkedin.com/feed/update/urn:li:share:7522938086641680385","text":"You fixed an XXE finding by hand. Months later it is back. XXE is mostly a configuration problem, not a library version problem. A SAML handler, an SVG preview or a partner feed reader arrives with a one line parse call, and nothing tells its author about the setting the other p…","full_text":"You fixed an XXE finding by hand. Months later it is back.\n\nXXE is mostly a configuration problem, not a library version problem. A SAML handler, an SVG preview or a partner feed reader arrives with a one line parse call, and nothing tells its author about the setting the other parsers have.\n\nOur new post makes it a pull request check. It covers the parser settings for Java, .NET, Python, PHP, Go, http://Node.js and Ruby, then three CI checks: a static rule for parser construction, a negative test with a DOCTYPE fixture the parser must reject, and runtime version assertions. It also lists library versions with XXE fixes, such as lxml 6.1.0 and Nokogiri 1.19.4, and notes that some advisories have no patched version at all.\nhttps://lnkd.in/gQUdsKQm","image":"https://safeguard.sh/social/f385ccf0049f.webp","media":"photo","image_w":640,"image_h":360,"published_at":"2026-11-02T08:30:09.466Z","related_blog_url":"https://safeguard.sh/resources/blog/stop-xxe-before-merge-parser-settings-ci-checks-and-upgrades"}],"page":1,"per_page":24,"total":525,"next":"https://safeguard.sh/api/social?page=2&per_page=24"}