phishing
Safeguard articles tagged "phishing" — guides, analysis, and best practices for software supply chain and application security.
27 articles
Open Redirect Vulnerabilities: How Attackers Abuse Them
An open redirect attack abuses a trusted domain's own redirect functionality to send victims to a malicious site — low severity on its own, but a key ingredient in phishing and OAuth token theft.
Open Redirect Vulnerabilities: What They Are and How to Fix Them
An open redirect vulnerability fix is usually a ten-line change, but the bug keeps shipping because redirects hide in login flows, tracking links, and OAuth callbacks. Here is how to find and close them.
What is Phishing
Phishing drives more breaches than any other attack vector. Here's how it works, how it hits software supply chains, and how to defend against it.
What is Social Engineering
Social engineering causes 68% of breaches per Verizon's 2024 DBIR. Learn how it works, common attack types, and how it threatens the software supply chain.
AI Deepfake Phishing Campaigns in 2025: When Seeing and Hearing Isn't Believing
AI-generated voice and video deepfakes powered a new wave of phishing campaigns in early 2025. The technology is cheap, the results are convincing, and defenses are lagging.
Developer Social Engineering Campaigns 2024-2025
State-aligned and financially motivated actors now target individual developers with bespoke social engineering. Here is the tradecraft and what engineering leaders must do.
Webmail Auth: How Email Authentication Actually Works
Webmail auth spans two very different problems: proving who a user is when they sign in, and proving a message really came from the domain it claims. Both matter for security.
OSS Maintainer Account Takeover Trends 2025
A senior engineer's breakdown of how maintainer account takeovers evolved in 2025, from phishing kits targeting PyPI to session token theft on GitHub and npm.
Business email compromise (BEC)
Business email compromise (BEC) tricks employees into wiring funds or data to attackers posing as executives or vendors. Here is how BEC fraud actually works.
Dark AI: How Attackers Weaponize Generative Models
Dark AI refers to generative models turned to malicious ends, from phishing at scale to malware assistance. Here is what defenders need to understand and do.
Email Security and Supply Chain Phishing Attacks
Phishing remains the top initial access vector for supply chain attacks. Targeted emails against developers, maintainers, and DevOps engineers open the door to code injection, credential theft, and pipeline compromise.
Dropbox Breach: Phishing Attack Exposes 130 Private GitHub Repositories
Attackers phished Dropbox employees by impersonating CircleCI, gaining access to 130 private GitHub repos containing internal code and credentials.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.