Application Security
Protecting Browser Saved Passwords from Theft (T1555.003)
Browsers store logins in files a local attacker can read. See how the technique works, what to monitor and how to cut the exposure.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Understanding Securityd Memory Credential Theft (T1555.002)
Root access once let attackers read keychain master keys from securityd memory. Learn the history, the risk and what to defend today.
Oct 18, 20262 min read
Application Security
Protecting the macOS Keychain from Credential Theft (T1555.001)
The macOS Keychain stores passwords, keys and certificates. Learn how attackers read it and why a separate keychain password helps.
Oct 18, 20262 min read
Application Security
Defending Password Stores from Credential Theft (T1555)
Keychains, browsers, password managers and cloud vaults all concentrate credentials. See how attackers target them and how to limit the blast radius.
Oct 18, 20263 min read
Application Security
Detecting Compromised Host Software Binaries (T1554)
Backdoored SSH clients and patched binaries give attackers durable access. Learn how it works and how signing, provenance and integrity checks help.
Oct 18, 20263 min read
Application Security
Detecting Code Signing Policy Modification (T1553.006)
Test Mode, disabled SIP and weakened driver enforcement let unsigned code run. Learn the commands attackers use and the settings that stop them.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Mark-of-the-Web Bypass (T1553.005)
Files inside ISO, VHD and archive containers may lose the Mark-of-the-Web and skip Protected View and SmartScreen. Here is how to close that gap.
Oct 18, 20263 min read
Application Security
Detecting Rogue Root Certificates on Your Systems (T1553.004)
A root certificate planted on a host removes the TLS warning for attacker sites. See how it works and how to audit and protect your trust stores.
Oct 18, 20264 min read
Application Security
Detecting SIP and Trust Provider Hijacking on Windows (T1553.003)
Windows signature checks run through SIPs and trust providers. See how registry tampering can fake a valid signature and how to lock those keys down.
Oct 18, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.