Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A hacking tool is only as good or bad as its operator. Here is how defenders should think about the tools attackers use, and how to turn them into a defensive advantage.
Code reviews are one of the cheapest security controls you have, but only if they look for the right things. Here is how to run secure code reviews that actually find vulnerabilities.
CVE-2022-31630 is an out-of-bounds read in PHP's GD extension triggered through imageloadfont(). Here are the affected versions, real impact, and the fix.
The openpyxl package on PyPI is safe for most workloads, but XML parsing and spreadsheet formula injection deserve attention. Here is what to watch for.
eslint-plugin-jest-dom enforces better jest-dom assertions, but as a dev dependency it also lives in your supply chain. Here is where its real security value and its real risk both sit.
A clear-eyed look at the static application security test: how SAST works, the vulnerability classes it finds, its blind spots and false positives, and how to run it without drowning developers.
How CVE-2023-45857 caused Axios to leak XSRF tokens to any host over cross-origin requests, who is affected, and the one-line upgrade that fixes it.
Seeing nginx/1.18.0 (ubuntu) in a Server header tells you the version, the packaging, and roughly the age of a deployment. Here is what that string implies for security and what to check before assuming you are exposed.
awesome-typescript-loader is an unmaintained webpack loader for TypeScript. Here is the security case for migrating to ts-loader and how to do it cleanly.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
