Best Practices
How to Scan Docker Images for Vulnerabilities
A production-grade vulnerability scanning pipeline for Docker images using Trivy and Grype, with reachability-based prioritization and admission enforcement.
Mar 17, 20267 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A production-grade vulnerability scanning pipeline for Docker images using Trivy and Grype, with reachability-based prioritization and admission enforcement.
GitHub Actions caches were never designed as a trust boundary. In 2025 researchers turned that mismatch into a repeatable supply-chain attack pattern.
NIST SP 800-161 Rev. 2 reshapes cyber supply chain risk management for federal contractors and commercial buyers. Here is what engineers must operationalize.
Researchers keep finding valid AWS, GitHub, and cloud credentials baked into public Docker Hub images. What the 2024 data shows and how to stop shipping secrets.
A benchmark you can't reproduce is marketing. A benchmark you can rerun on your own infrastructure is evidence. The reproducibility gap is wide.
Prompt injection is the defining AI security problem of this generation. The defences are structural, not cosmetic — and the architectural choices show.
Windsurf's Cascade agent is among the more capable in-editor agents. For security review specifically, it's a complement to Griffin AI, not a replacement.
Supply chain security for aerospace and defense contractors in 2026 means CMMC 2.0 final rule, DFARS 7012/7020/7021, and NIST 800-171 Rev 3 in production.
AI-for-security metrics that show up on board slides are different from the ones engineers use day-to-day. Designing both sets properly is the work.
Weekly insights on software supply chain security, delivered to your inbox.