Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A test plan for chatbots and agents built into your product: direct and indirect injection, excessive agency, cross-user data, and output handling, mapped to OWASP's 2025 LLM Top 10.
A peft advisory published 5 August 2026 shows how one unguarded torch.load call undoes a project's own safe-loading wrapper. Here is how to load models without executing code.
The 2026 edition reorders the list and renames System Prompt Leakage. Here are all ten entries with one concrete engineering control each, plus where the list stops and the agentic list begins.
The 2026-07-28 MCP revision changes auth, deprecates Dynamic Client Registration and removes sessions. Use it and the spec's security page as a checklist before you approve a server.
OWASP moved Excessive Agency to third place in its August 2026 LLM list. Here is a short, concrete way to scope what an agent's tools can do.
A Qdrant advisory shows a read-only credential can still write files on the vector store host. Use it to review every stage of your RAG pipeline.
Three 2026 documents point the same way on agent audit trails. Here is a minimum log record you can add today, with tool calls tied to a human and a trace.
A June 2026 paper tests deterministic out-of-band defenses against adaptive attacks. Combined with the 2025 result that broke twelve in-band defenses, it shows where to spend your effort.
NIST's agent hijacking evaluation raised attack success from 11% to 81% by moving from baseline to tailored attacks. Here is a one-week red team plan for a single LLM feature.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
