Application Security
Griffin AI in Safeguard: from finding to fix plan
Griffin AI is the reasoning core behind Safeguard's findings and fixes. The six stages the product page lists, and what to verify before you trust a fix.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Safeguard Auto-Fix: fixing in source and in container images
Auto-Fix works in two places: source code and deployed container images. What the product page says each side does, and what it leaves unsaid.
Oct 18, 20262 min read
Application Security
Safeguard Guard: runtime guardrails, monitor first, then enforce
Guard checks requests, queries, shell commands and AI traffic against rules you write once. It is generally available. Here is how it deploys and why monitor mode comes first.
Oct 18, 20262 min read
Application Security
Safeguard SCA: indirect dependencies and reachability
What Safeguard's composition analysis covers: ecosystems, lockfiles, reachability verdicts, SBOM formats and CI. And one inconsistency on the page to check.
Oct 18, 20262 min read
Application Security
Safeguard Scanner Suite: eleven scanners, one deduplicated list
Scanner Suite runs several scanners in one pass and merges the results. What it covers, the feeds behind it, and the outputs it lists.
Oct 18, 20262 min read
Application Security
Safeguard DAST: authenticated scans that start from the code
Safeguard's dynamic scanner uses the static call graph and route table as input. What it supports for authentication and CI, and which claims to test.
Oct 18, 20262 min read
Application Security
File formats Safeguard supports: manifests, SBOMs, binaries, advisories
The file types Safeguard reads, from package manifests and SBOMs to Windows, Android, iOS and Java binaries and CSAF and VEX documents, as the docs list them.
Oct 18, 20263 min read
Application Security
Kestra CVE-2026-49869: A Suffix Match That Gave Away Root RCE
Kestra OSS skipped Basic Auth for any API path ending in /configs, which let anyone create and run a workflow as root. CISA added it to KEV on 2 September 2026.
Oct 18, 20265 min read
Application Security
Starlette BadHost CVE-2026-48710: A Python Library Lands in CISA KEV
A malformed Host header made Starlette's request.url.path differ from the routed path, bypassing path-based auth. Fixed in 1.0.1. CISA added it to KEV on 2 September 2026.
Oct 18, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.