Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
HashiCorp's go-getter wrote S3 and GCS directory downloads outside the destination, and kept extra permission bits from archives. How to find it in your Go binaries.
NIST released the SP 800-82 Rev. 4 draft on 21 September 2026. It restructures OT security around CSF 2.0 and lists SBOMs, HBOMs and signed artifacts as supplier evidence.
Hydra published four high severity advisories on 7 October 2026 showing untrusted configs could still run code. Fixed in hydra-core 1.3.7 and hydra-optuna-sweeper 1.3.0.
Two compromised actions came back in September with malicious tags intact. Inventory action refs across your org, trace past runs, then require full commit SHAs.
@subql/common 5.8.3 ran on install and again on import. Here is how to block install scripts, catch import-time side effects in CI, and cover Python too.
GhostAction's October wave pushed a fake security audit workflow to over 30,000 repos. Map which repos can read which secrets, then shrink that reach with environments and OIDC.
A step-by-step org-wide sweep for a known-bad npm version using GitHub SBOM exports, code search, lockfile queries and CI run history, with tensorlake and @subql/common as examples.
tensorlake 0.5.144 went from a direct push to main to npm with valid provenance. Rulesets, tag rules and a protected publish environment put a human in that path.
Miri wrote every environment variable into target/. If your CI caches that directory and pull requests can read the cache, secrets were exposed. Here's how to check.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
