AI Security
Is a joblib or scikit-learn model file safe to load?
Loading a joblib or pickle model file can execute arbitrary code. Learn when it is acceptable, plus safer formats the scikit-learn docs describe.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Hugging Face Spaces secrets incident (May 2024): what was disclosed
What Hugging Face said about unauthorized access to Spaces secrets in May 2024, what it changed afterwards, and what the disclosure left unstated.
Oct 18, 20263 min read
AI Security
How do you turn on authentication for an MLflow tracking server?
Install the auth extras, set a secret key and admin password, then start the server with the basic auth app name. Permission levels and caveats.
Oct 18, 20263 min read
AI Security
How do you test an LLM app for prompt injection and grade it?
Test prompt injection with dummy data and instrumented tools, grade each security goal separately, repeat runs, and never count errors as blocked attacks.
Oct 18, 20264 min read
AI Security
How do you give an AI step in an automation access to payments safely?
Give an AI automation a restricted, separately tagged key, require human approval for refunds and payouts, and log every call. Steps and a risk table.
Oct 18, 20264 min read
AI Security
How do you give an AI agent read-only access through MCP?
Read only is a property of the credential and the downstream system, not a hint on the tool. How to enforce read only access for an AI agent over MCP.
Oct 18, 20263 min read
AI Security
How do you convert a pickle checkpoint to safetensors safely?
Converting a pickle checkpoint means loading it first. Do it in a sandbox with weights only loading, then save tensors and record a new digest.
Oct 18, 20264 min read
AI Security
How do I choose AI agent governance tooling? Eight questions
Choosing AI agent governance tooling comes down to eight questions about discovery, access, approvals, logs, failure modes and exit. Ask them in a trial.
Oct 18, 20264 min read
AI Security
How does MCP step-up authorization work (401 versus 403)?
A 401 means authorization is needed or the token is invalid. A 403 with insufficient_scope tells the client to request more scope. Here is the full flow.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.