SBOM
CycloneDX Specification Deep Dive: Beyond the Basics
CycloneDX is more than a component list. This deep dive covers services, vulnerabilities, compositions, and the parts of the spec most teams overlook.
Jan 8, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance & Regulations
CISA SBOM Guidance: What Government Agencies Need to Know
CISA's evolving SBOM requirements are reshaping how government agencies procure and manage software. Here's what the guidance says and how to operationalize it.
Jan 8, 20265 min read
Application Security
Regular Expression Denial of Service (ReDoS): Detection and Prevention
A single bad regex can bring down your entire application. ReDoS attacks exploit catastrophic backtracking to consume unbounded CPU time.
Jan 8, 20264 min read
DevSecOps
Feature Flags Security Implications
Understanding the security risks of feature flag systems and how to prevent unauthorized flag manipulation, data exposure, and configuration drift.
Jan 8, 20266 min read
AI Security
Specialised Security LLM vs Frontier Model: The Choice
Frontier models are general polymaths. Security-specific LLMs are narrow experts. Choosing between them is rarely about raw intelligence and almost always about cost, latency, and the shape of your data.
Jan 8, 20267 min read
AI Security
Reachability Analysis: Griffin AI vs Mythos
Reachability-grounded reasoning produces actionable findings. Ungrounded LLM reasoning produces speculation. We explain the methodology gap.
Jan 8, 20266 min read
AI Security
Griffin AI vs Pure GPT-5 for Security Workflows
Frontier models are remarkable reasoners, but security workflows demand more than raw intelligence. Here's how Griffin AI grounds frontier reasoning in real tenant context.
Jan 8, 20267 min read
AI Security
AI Agent Tool-Scope Enforcement Patterns
Agents get tool lists, not tool boundaries. We walk through scoping patterns that actually hold when Claude 4 or GPT-5 picks the wrong function at runtime.
Jan 8, 20266 min read
Compliance & Regulations
NIST SP 800-218 (SSDF) Final Publication: What It Means for Your Organization
NIST finalized the Secure Software Development Framework in February 2022. If you sell software to the US government — or plan to — compliance is no longer optional.
Jan 8, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.