Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Veradigm says credentials for one of its APIs were taken from a vendor's environment and used to download patient data, some with SSNs. How to audit API credentials you give vendors.
Trezor's ShipMonk breach grew to about 81,000 customers after the logistics provider turned out to still hold 2019 to 2021 order data it had confirmed deleting. How to verify vendor deletion.
An attacker abused how Brevo scoped SAML SSO to reach 138 customer accounts, export contacts and send phishing that passed email authentication. Trezor's list was one of them.
Bitget lost up to 387.5 million US dollars after attackers compromised two third-party security products and moved to its wallet server. What the Mandiant and SlowMist reports say.
A flaw in Gyazo's image upload server exposed 23.62 million user records, including session IDs and X integration tokens, plus OCR text from image metadata. What teams should check.
Someone misused a private company's legitimate access to Denmark's CPR register to pull names, addresses and CPR numbers of about 8.8 million people. The lesson is about partner accounts.
The notification is vague, late, and does not say whether you are affected. It starts several clocks, and one of them may be a 72-hour regulatory deadline that runs from when you became aware, not when their investigation finishes.
The first message has to go out before the investigation finishes. What to say at each stage, the order that establishes scope, and why historical lockfiles turn a week of archaeology into a query.
N-able patched an authentication bypass in N-central. Attackers found what the patch missed and used it as a zero-day, pivoting into Microsoft 365 and Okta. Incomplete fixes are their own bug class.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
