Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
We counted GitHub-reviewed advisories that describe an incomplete fix or patch bypass. In 2026 they are 2.31% of all advisories, up from under 0.4% a year. The data, the bug classes that keep coming back, and what to change in how you ship a fix.
A CVE being public and your scanner knowing about it are two different events. For open-source packages, the gap between them is mostly the time it takes GitHub to review the advisory and map it to a package name and version range. In 2025 that usually took about half a day. In June 2026 the median was 38 days.
In 97% of 4,259 PyPI and npm advisories published in 2026, the fixed version was on the registry before the advisory went public, by a median of 10 days. Why the advisory is a late signal, this week's examples, and how to watch releases without walking into compromised updates.
The Safeguard Research team measured SBOM quality across ecosystems and generators. The gaps between formats, tools, and languages are larger than most teams assume.
The Safeguard Research team built a risk index for transitive dependencies and ranked the ten categories that concentrate the most risk in modern stacks.
The Safeguard Research team measured how often AI coding assistants hallucinate non-existent packages, how sticky those hallucinations are, and what defenders should do.
The Safeguard Research team measured how much abandonment exists in real dependency graphs, how it correlates with risk, and what to do about it.
The Safeguard Research team ran reachability analysis across a large corpus of real codebases. This is what we learned about which CVEs actually matter.
The Safeguard Research team analyzed first-quarter 2026 malicious package telemetry across npm, PyPI, RubyGems, and crates.io. Here is what the data shows.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
