Buyer's Guides
GitHub-only lock-in: why GHAS doesn't support GitLab, Bit...
GHAS only scans GitHub repos. For orgs running GitLab, Bitbucket, or self-hosted Git, that's a real coverage gap. Here's how Safeguard closes it.
Jul 3, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIndustry Analysis
Secure Random Number Generation in C# with RandomNumberGe...
Why System.Random is a security liability in C# and how RandomNumberGenerator prevents predictable tokens, nonces, and keys in .NET applications.
Jul 3, 20266 min read
AI Security
Embedding Model Supply Chain Risks
Embedding models are the silent dependency under every RAG system. We cover poisoning, deprecation, and provenance gaps that break retrieval in production.
Jul 3, 20265 min read
Software Supply Chain Security
Axios npm package RAT supply chain compromise
A compromised maintainer account pushed malicious axios releases carrying a cross-platform RAT to npm on March 31, 2026 — here's the full timeline and IOCs.
Jul 3, 20267 min read
Industry Analysis
Secure Random Number Generation in Java with SecureRandom...
Why java.util.Random and even UUID.randomUUID() can leak predictable tokens, and how Java's SecureRandom and NIST DRBG providers actually protect secrets.
Jul 3, 20267 min read
Application Security
Secret scanning coverage: GHAS's ~200 patterns vs broader...
GHAS matches secrets against ~200 partner patterns. We break down where that coverage ends and how Safeguard's layered detection catches what pattern lists miss.
Jul 3, 20268 min read
Vulnerability Analysis
CVE-2018-16487: Prototype pollution in lodash via merge/m...
CVE-2018-16487 let attackers pollute Object.prototype through lodash's merge, mergeWith, and defaultsDeep — a bypass of an earlier fix, patched in 4.17.11.
Jul 2, 20267 min read
Vulnerability Analysis
CVE-2020-8203: Prototype pollution in lodash zipObjectDeep
CVE-2020-8203 lets attackers pollute JavaScript's Object prototype via lodash's zipObjectDeep function, risking DoS or RCE in downstream apps.
Jul 2, 20268 min read
Containers
Docker Meaning: What Docker Is and Why It Matters for Security
Docker packages an application and everything it needs into a portable container that runs the same everywhere. Understanding that model is the first step to securing it.
Jul 2, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.