Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Checkov before 3.3.25 can be made to write files anywhere on the scanning host. If CI scans pull requests from forks, upgrade and stop auto-loading config from the repo.
SAP's October 2026 Patch Day put a pip package at the top of the list. sap-cloud-sdk before 0.45.2 lets a tenant_subdomain value redirect OAuth2 token requests.
PyJWT fixed 14 issues in September, including four new ways around its HS/RS key confusion guard. Most need a mixed algorithms list. Check yours in one grep.
Fastify disclosed an auth bypass via malformed URLs, three schema validation bypasses and an HTTP/2 crash in September. Each needs a specific pattern. Grep for them.
One link opened by a signed-in TinaCMS editor could hand an attacker that editor's access to the content API. How the preview origin check was defeated, why filtering the URL would not have worked, and two sibling bugs fixed in the same release.
Microsoft fixed 46 .NET vulnerabilities on 13 October 2026. Here is what to patch first, why the ASP.NET Core Identity password-reset fix (CVE-2026-70175) doesn't reach Blazor template code in your repo, and a script to check every runtime and SDK on a machine.
.NET 8 and .NET 9 both reach end of support on 10 November 2026. After that date Microsoft ships no fixes for either, security fixes included, and the official container images for both stop being rebuilt. Your vulnerability scanner will also go quiet about them, for a reason that has nothing to do with being safe.
Sorting 2,000 findings by CVSS spends your first hour on the scariest score, not the biggest risk. Here's a better order: known exploited, reachable, exposed, likely, then the rest.
Your OpenAPI file and your JavaScript bundle rarely agree. Here's how Safeguard DAST now finds, shapes and confirms the API calls hiding in the front end.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
