Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Malicious Baileys forks use the bot's own WhatsApp session to follow channels. OSV data to 17 Oct, why npm defenses miss it, and a checker.
pip's hash-checking mode blocks tampered packages, but build dependencies skip it and pip 26.2 adds an opt-out. Offline lab and an audit script.
19 PyPI packages posing as TTS and speech tools hid a Monero miner behind fake training logs and a Cloudflare tunnel. What they did and how to check.
Since August, 115 of 117 new RustSec advisories never reached GitHub's reviewed database, so Dependabot misses them. The 2026 data and a lockfile checker.
Run Safeguard's scans on your own runners or inside your CI, so your source code stays on your infrastructure and only findings leave.
Gold's free dependency scan checks a package.json, requirements.txt or SBOM against known vulnerabilities in your browser. No login, and the file never leaves your machine.
A typosquat of boltdb/bolt stayed cached on Go's module proxy for roughly three years after its source repo was cleaned up — proxy caching beats takedowns.
event-stream hid a wallet-stealing payload behind 8M downloads in 2018. Here's how typosquatting and dependency confusion actually work, and how to stop them.
Supply-chain attacks are up 650% year over year, per the SLSA framework — yet most teams still map risk to one surface instead of four.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
