sonatype
Safeguard articles tagged "sonatype" — guides, analysis, and best practices for software supply chain and application security.
17 articles
Nexus Repository Manager 3 Remote Code Execution (CVE-202...
CVE-2020-10199 is a critical Java EL injection flaw in Sonatype Nexus Repository Manager 3 letting authenticated users achieve remote code execution.
Nexus Repository Manager Authenticated RCE via EL Injecti...
CVE-2020-10204 lets an authenticated Nexus Repository Manager user execute arbitrary code via EL injection. Here is what changed and how to respond.
Sonatype Trust Center and Security Program Overview
Sonatype's trust center offers compliance snapshots on request. Safeguard compares that model to continuous, evidence-based supply chain verification.
Sonatype Nexus Repository Manager Alternatives
Evaluating Nexus Repository Manager alternatives? A concrete look at reachability analysis, scanner fusion, auto-fix, and AI/MCP governance versus Sonatype.
How to evaluate software supply chain security vendors us...
A practical framework for evaluating software supply chain security vendors on verifiable dimensions—SBOM support, provenance, deployment model—rather than analyst labels alone.
AI Is Forcing a New Open Source Security Model
AI coding agents now choose dependencies — and attackers are exploiting hallucinated packages and MCP backdoors that legacy SCA tools like Sonatype's were never built to catch.
From SBOMs to AI BOMs: SPDX 3.0 Explained
SPDX 3.0 adds a formal AI profile for documenting ML models and datasets. Here's what changed, how it compares to CycloneDX, and why it matters now.
Sonatype Firewall: Malicious Package Protection
Sonatype's Repository Firewall blocks known malicious packages at the door, but timing gaps and single-source blind spots still let real threats through.
Sonatype SBOM Manager Overview
A concrete look at Sonatype SBOM Manager — its origins, pricing model, VEX support, and common adoption gaps — for teams evaluating an SBOM manager tool.
Sonatype Guide: Securing Agentic AI Development
Sonatype's new guide reframes AI dependency risk, but its scanner-based model can't govern agents that install packages and call MCP tools on their own. Here's the gap and how to close it.
What Are Open Source Vulnerabilities
Open source vulnerabilities explained: how flaws like Log4Shell and XZ Utils spread through dependency trees, how Sonatype tracks them, and how to prioritize fixes.
What Is Shift Left Security
Shift left security moves scanning earlier in the SDLC. Here's what it means, how Sonatype approaches it, where it falls short, and how Safeguard closes the gap.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.