Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
containerd 2.1 to 2.3 restored checkpoint images with saved privileges, ignoring the pod security context. Versions, the fix and a checker script.
FrankenPHP worker mode could hand one user's PHP session to another when session was a shared module. Who was exposed, the fix, and a checker.
TanStack Start 1.143.12 to 1.168.59 let a crafted server-function URL serve attacker HTML. What broke, the fix, and a lockfile and edge-rule checker.
CVE-2026-96620: the Claude Agent SDK for Python passed resume as two argv tokens, so a dash-led session ID injected CLI flags. Fixes, TS builds, a checker.
LMCache CVE-2026-105192: one ZeroMQ message ran code via pickle. 0.5.6 fixes it, but example manifests and images lag. Safe setup steps and a checker.
Wasmtime CVE-2026-58494: a WASI guest could hard-link a read-only file into a writable preopen and overwrite it. Who's exposed, the fix, and a checker.
Arcane, a Docker management UI, published 14 advisories in 2026; 7 were access-control failures. Why these UIs fail, a test that catches it, and a checker.
Apprise and Dio resent secret headers to redirect targets. We tested nine HTTP clients: all leaked a custom API key header. Defaults, fixes and a lab.
JupyterLab's command-link trust prompt could trust whichever document was current, not the clicked one. Versions, the fix, a test pattern and a checker.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
