sca
Safeguard articles tagged "sca" — guides, analysis, and best practices for software supply chain and application security.
469 articles
CVE-2021-43527: The NSS Heap Overflow Explained
CVE-2021-43527 is a critical heap buffer overflow in Mozilla NSS that can lead to remote code execution when verifying certain digital signatures.
SAST vs DAST vs SCA: choosing the right tool
SAST, DAST, and SCA each answer a different security question — here's what each catches, when to run them, and how to prioritize the flood of findings.
Why Transitive Dependencies Are the Blind Spot in Most Vu...
Most vulnerability scans stop at direct dependencies, missing the 70-80% of your codebase that arrives transitively — where Log4Shell and other major CVEs actually hid.
What Are Open Source Vulnerabilities
Open source vulnerabilities explained: how flaws like Log4Shell and XZ Utils spread through dependency trees, how Sonatype tracks them, and how to prioritize fixes.
Dependabot Alternatives in 2026: An Honest Buyer's Guide
An honest guide to Dependabot alternatives in 2026 — Renovate, Snyk, Socket, Endor Labs, Mend, and Safeguard — covering dependency updates, reachability analysis, malicious-package detection, and software supply chain security.
Direct vs Transitive Vulnerabilities: Why the Distinction...
Most CVEs in your stack aren't in packages you chose — they're transitive. Here's why direct vs transitive vulnerabilities need different fixes and different priority.
From Log4Shell to Now: What Changed and What Didn't in Su...
Three years after Log4Shell, Log4j is still found in production systems. Here is what the industry fixed, what it didn't, and why the risk persists.
Apache Tomcat and Coyote Connector Vulnerabilities Explained
Apache tomcat vulnerabilities keep surfacing because Tomcat sits directly in the request path of so many Java applications; here is what the Coyote connector does and which vulnerability classes recur most.
Snyk Alternatives in 2026: 8 Options Compared
An honest, opinionated guide to the best Snyk alternatives in 2026 — Endor Labs, Socket, Mend, Aikido, Semgrep, Sonatype, Trivy, and Safeguard — with a fair blurb and a 'best for' line for each, plus where reachability and remediation actually matter.
Vulnerability scanning tools and techniques compared
A verifiable comparison of Safeguard and JFrog Xray on scan coverage, data sourcing, reachability analysis, and CI/CD integration for vulnerability scanning.
Choosing a Code Analysis Tool: A Practical Security Guide
What a code analysis tool actually does, how static source code analysis differs from dependency scanning, and how to pick one that finds real bugs instead of noise.
Choosing a Docker Node Version: A Security Guide
The Docker Node version you pin decides your patch cadence, image size, and vulnerability exposure. Here is how to pick and maintain a Node base image safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.