AI Security
Securing AI coding IDE extensions and plugins
VS Code themes with 9M installs shipped backdoors; Cursor's rules files were hijacked in 2025. Here's what AI IDE extension security actually requires.
Jun 5, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedThreat Intelligence
Sonatype Firewall: Malicious Package Protection
Sonatype's Repository Firewall blocks known malicious packages at the door, but timing gaps and single-source blind spots still let real threats through.
Jun 5, 20267 min read
AI Security
LLM output validation and sanitization best practices
LLM output is untrusted input to everything downstream. Here's how to validate, encode, and sandbox it before it becomes your next injection vector.
Jun 5, 20267 min read
SBOM
Sonatype SBOM Manager Overview
A concrete look at Sonatype SBOM Manager — its origins, pricing model, VEX support, and common adoption gaps — for teams evaluating an SBOM manager tool.
Jun 5, 20266 min read
AI Security
Zero-day risk in third-party AI model dependencies
Malicious Hugging Face models, a trojanized Ultralytics PyPI release, and a torch.load bypass show AI model dependencies now carry real zero-day risk.
Jun 5, 20266 min read
AI Security
Sonatype Guide: Securing Agentic AI Development
Sonatype's new guide reframes AI dependency risk, but its scanner-based model can't govern agents that install packages and call MCP tools on their own. Here's the gap and how to close it.
Jun 5, 20269 min read
AI Security
Mapping AI-generated code risks to the CWE Top 25
45% of AI-generated code fails security tests. Here's how CWE Top 25 weaknesses like XSS, SQLi, and broken auth map to specific LLM coding habits.
Jun 5, 20267 min read
Regulatory Compliance
Open Source License Compliance Management
Open source license compliance is now a continuous, automated discipline. Here's what Sonatype gets right, where it falls short, and how Safeguard unifies license risk with vulnerability management.
Jun 5, 20268 min read
Industry Events
Gartner SRM Summit 2026 Recap: Agentic AI Security and the Post-Quantum Clock
Gartner's Security & Risk Management Summit landed on four forces every security leader now has to navigate. Two of them — agentic AI security and the post-quantum world — dominated the room. Here's our honest read on what mattered.
Jun 4, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.