Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Adobe's October 2026 bulletin for c2pa-rs, c2patool and @contentauth/c2pa-web lists 30 CVEs, most of them ways to make provenance checks pass when they should fail.
Credentials held by the Ribon apps on BigCommerce were compromised and used against merchant stores from 13 to 17 September 2026. How merchants can audit installed apps and scripts.
Meta says an outside group used an employee's stolen credentials to take code and personal data of about 1,500 people from some of its GitHub repositories. What to check in your org.
From August 2024 until 30 September 2026, converting a Docker Hub personal account into an organization quietly handed the account's personal access tokens to whoever was named as the new owner, without changing the token secrets.
Renovate reads its configuration from the repositories it updates, and that configuration can pull in shared presets from other repositories, npm packages or any HTTP URL.
GitPython published 39 advisories from April to October 2026, most variations of git option injection. What they share, why denylists fail, and what to do.
We ran YAML alias bombs against nine parsers. Four refused them; PyYAML, goccy and others didn't. CVE-2026-72923 fixes, limits that fail, and a guard.
0.0.1-security means npm removed a malicious package. Our data on 1,277 reports: newest versions stayed up a median 18.5 days. Plus a lockfile checker.
A projected service account token with no audience works against the Kubernetes API. How to issue audience-bound tokens and find the risky ones.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
