Application Security
When Attackers Sign Their Malware: Code Signing (T1553.002)
A valid signature does not mean safe software. Learn how code signing gets abused and why provenance and attestation checks matter.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Detecting and Mitigating macOS Gatekeeper Bypass (T1553.001)
Gatekeeper checks quarantine flags, signatures and notarization before an app runs. See how attackers sidestep those checks and what to enforce.
Oct 18, 20262 min read
Application Security
Detecting and Mitigating Subverted Trust Controls (T1553)
Signed code, download warnings and trusted certificates all assume nothing tampered with them. Learn how attackers undermine them and how to harden each one.
Oct 18, 20263 min read
Application Security
Finding Credentials Shared in Chat Messages (T1552.008)
Passwords and API keys end up in Slack, Teams, email and Jira. Here is how attackers read them and how to audit and reduce what is exposed.
Oct 18, 20263 min read
Application Security
Detecting and Mitigating Container API Credential Theft (T1552.007)
How attackers pull credentials out of the Docker and Kubernetes APIs, what to log, and how to lock down service accounts and API access.
Oct 18, 20264 min read
Application Security
Group Policy Preferences Passwords: Detection and Cleanup (T1552.006)
Passwords stored in Group Policy Preferences sit in SYSVOL where any domain user can read them. MITRE T1552.006 explained, with the audit and the patch it recommends.
Oct 18, 20262 min read
Application Security
Protecting the Cloud Instance Metadata API From Abuse (T1552.005)
The metadata service at 169.254.169.254 can hand out credentials to anyone who reaches it, including through SSRF. MITRE T1552.005 explained, with detection and hardening steps.
Oct 18, 20264 min read
Application Security
Private Key Theft: Detection and Protection (T1552.004)
SSH keys, certificates and device keys are credentials, and attackers search for them. MITRE T1552.004 explained, with file types, detection signals, mitigations and read-only checks.
Oct 18, 20264 min read
Application Security
Passwords in Shell History: Detection and Prevention (T1552.003)
Command history files keep what users typed, including passwords passed as arguments. MITRE T1552.003 explained, with file locations, detection signals and history settings.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.