AI Security
How many tool calls should an AI agent be allowed per task?
There is no universal number, but every agent needs a cap on calls and loop turns. How to set limits, what the MCP spec says and what to do at the cap.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
How does a restricted unpickler block malicious model files?
A restricted unpickler overrides find_class to allow only named classes. Learn how it works, what it stops in model files, and where it falls short.
Oct 18, 20264 min read
AI Security
How do secrets leak through AI coding assistants, and how to stop it?
Secrets leak via prompt context, generated code and pasted logs. Four controls stop most of it: file exclusion, deny rules, scanning and rotation.
Oct 18, 20264 min read
AI Security
Hosted model API or self-hosted: who owns which security task?
A responsibility table for calling a hosted model API versus running your own serving stack, so an AI startup knows which security tasks stay with it.
Oct 18, 20263 min read
AI Security
Gemini shared chat links: who can read them and how to delete
Anyone with a Gemini share link can read the chat, including uploaded images. How links are created, why they die, and how to delete one or all.
Oct 18, 20263 min read
AI Security
Gemini Keep Activity off or Temporary Chat: what each one does
Keep Activity off and Temporary Chats both stop training use, but both still keep chats for 72 hours. Differences, side effects and when to pick each.
Oct 18, 20263 min read
AI Security
Gemini human review: why deleting activity may not remove a chat
Google says a subset of Gemini chats is read by human reviewers and kept up to three years, even after you delete activity. What that means for you.
Oct 18, 20263 min read
AI Security
Gemini Connected Apps: what you hand over and how to disconnect
Connected Apps let Gemini work with Google apps and third party services. Google says it does not secure custom third party apps. Risks and how to leave.
Oct 18, 20263 min read
AI Security
How do I find the AI agents already running in my company?
Find AI agents already in use by checking six sources: developer machines, repositories, identity logs, cloud accounts, expense records and a team survey.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.