Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Only 15% of 2026 GitHub advisory fixes reach more than one major line. What that means for KEDA, Better Auth and DOMPurify 2.x users, plus a check.
gh attestation verify is only as strict as the identity you pin. After CVE-2026-64655: the flags to use, fields to trust, and an exact-match ID policy.
Twelve kin-openapi advisories in 2026: one kills the process, two bypass ValidationHandler auth. What we tested, what to upgrade, and a checker.
We matched 1,982 GitHub Go advisories to the Go vulnerability database: 99.1% coverage, 10.7-day median delay, and 84.7% of 2026 entries lack symbol data.
MCP Python SDK before 1.30.0 and 2.2.0 never freed Streamable HTTP sessions. What we measured, how to size the new limits, and a server checker.
Nine of mise's 12 advisories in 2026 started with a file in a cloned repo. Why content-based trust fails open, paranoid mode, and a repo review script.
Nginx UI ships 2.x releases from a v1 Go module path, so scanners miss or never clear its 2026 advisories. The data, a fix map, and a version checker.
Malicious npm packages hide payloads behind URL dependencies. How allow-remote and lockfiles stop them, which Node versions lack it, and a scanner.
240 malicious npm and PyPI packages in 2026 carry AI-tool names. Most got in the old way and ran via MCP launch commands. The data and a config checker.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
