Open Source Security
OSS Review Toolkit (ORT): Automating License Compliance at Scale
The OSS Review Toolkit handles license scanning, vulnerability detection, and compliance policy enforcement. Here's how to put it to work.
Jan 15, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDependency Management
Migrating Dependencies for Security: A Step-by-Step Guide
When a dependency becomes a security liability, migration is the only real fix. Here is a structured approach to dependency migration that minimizes risk and disruption.
Jan 15, 20266 min read
AI Security
CycloneDX Support: Griffin AI vs Mythos
CycloneDX is not a text format to be summarized — it's a typed graph with dozens of semantically-rich fields. Griffin AI consumes it as a graph. Mythos-class tools consume it as tokens. That difference decides every downstream finding.
Jan 15, 20267 min read
AI Security
Griffin AI vs Gemini Ultra for Security Reasoning
Gemini Ultra sets a high bar on complex reasoning benchmarks. But security reasoning is not benchmark reasoning. Here's how Griffin AI's engine-first approach changes the outcome.
Jan 15, 20267 min read
Cloud Security
GCP Artifact Registry Vulnerability Scanning: Integrating the Findings
Artifact Analysis on Artifact Registry produces a steady stream of findings. The discipline is in what you do with them. We map the workflows that actually reduce risk.
Jan 15, 20267 min read
AI Security
Context Window As A Security Limit
The context window is usually marketed as a capability parameter. In a security setting, it behaves like a budget, a forgetting function, and an attack surface all at once.
Jan 15, 20268 min read
AI Security
CycloneDX ML-BOM in 1.7: Implementation Guide
CycloneDX 1.7 was published in October 2025 and adopted by the General Assembly in December. We unpack what the ML-BOM capability means in practice for AI inventory.
Jan 15, 20267 min read
Regulation
CRA Product Classes: Implementing Regulation 2025/2392 Technical Descriptions
Commission Implementing Regulation (EU) 2025/2392 was signed on 28 November 2025, setting the technical descriptions for important and critical CRA product categories.
Jan 15, 20267 min read
AI Security
Anthropic MCP Security Model: A Deep Dive
Anthropic's Model Context Protocol introduces a new trust boundary between agents and tools. Here is how the security model actually works in practice.
Jan 15, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.