Open Source Security
JSR JavaScript Registry Security Model
JSR reimagines JavaScript package distribution with mandatory signing, scoped namespaces, and provenance by default. Here is how the security model works.
Mar 8, 20265 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
JSR reimagines JavaScript package distribution with mandatory signing, scoped namespaces, and provenance by default. Here is how the security model works.
Enterprise MCP deployments need more than a static API key. The protocol is evolving toward OAuth 2.1 and dynamic client registration, and understanding which pattern fits which workload decides whether your rollout survives the first audit.
The Snowflake customer breaches of 2024 were not a Snowflake compromise. Infostealer logs, shared credentials, and absent MFA did the damage, from Ticketmaster to AT&T.
Where software signing stands today, what Sigstore and friends changed, and why most organizations still ship unsigned artifacts.
AI red teaming is not a one-off exercise. Programmatic red-teaming of AI systems requires specific structure — and most organisations don't have it yet.
Scanning bursts when a monorepo merges. We explain why Griffin AI absorbs the spike gracefully while Mythos-class tools degrade into rate-limit queues.
Frontier models pass eval benchmarks that open-weight models miss by specific measurable margins. For security workflows, the gap matters.
Akira has industrialized VPN appliance exploitation. Here is the tradecraft, the advisories that document it, and what defenders must do about edge software supply chain risk.
A senior engineer's breakdown of how maintainer account takeovers evolved in 2025, from phishing kits targeting PyPI to session token theft on GitHub and npm.
Weekly insights on software supply chain security, delivered to your inbox.