Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A shared vector store can return one customer's content to another. How permission-aware retrieval, partitioning and audit logs keep RAG tenants apart.
Streaming makes chat feel fast but complicates output filters. Three designs for checking streamed replies, with the trade-offs of each one explained.
Time saved is easy to count and easy to misread. Track misses, agreement with senior analysts and analyst edits to see whether AI triage is safe.
In 2026 attackers reportedly used Meta's AI support assistant to reset Instagram accounts. What was reported and how to design safe AI account recovery.
MCP servers can announce that their tools changed. Without a review step, an agent's capabilities can grow unnoticed. How to detect and control it.
The MCP spec says clients must treat tool annotations as untrusted unless the server is trusted. What that means for approval logic and auto-run rules.
Stolen MCP tokens look like legitimate requests. The spec asks for secure storage, short-lived access tokens and refresh rotation. Details and a checklist.
How the resource parameter from RFC 8707 binds an MCP access token to one server, and what an MCP server must check before trusting a token.
MCP servers must not use sessions for authentication. Learn the two session hijack attacks and how to bind session IDs to the authenticated user.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
