Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2020-14343 lets attackers run arbitrary code via PyYAML's python/object/new tag, bypassing an earlier FullLoader fix. Versions, CVSS, and remediation inside.
CVE-2022-22817 lets attackers achieve arbitrary code execution via Pillow's ImageMath.eval() when environment data is attacker-controlled. Patch to 9.0.1+.
Source code protection is less about obfuscation and more about controlling access, catching secrets before they leak, and knowing when your code has escaped. Here is how to do it.
The AGPL licence closes the SaaS loophole in the GPL by triggering source-sharing over the network. Here is what it obliges, and where it bites teams by surprise.
JavaScript DI (dependency injection) decouples your code, but the container that wires it together is also a place security can slip. Here is how to use it well.
A cloud audit is a systematic review of your cloud accounts against security and compliance baselines. Here is a practical process covering identity, configuration, logging, and evidence.
A heap buffer overflow in Pillow's SGI image decoder (CVE-2021-25287) let crafted images corrupt memory. Here's the impact, fix, and remediation guidance.
CVE-2021-25288 is a buffer overflow in Pillow's FLI decoder, fixed in Pillow 8.1.0. Here's what's affected, the risk profile, and how to remediate.
A buffer over-read in Pillow's PCX decoder (CVE-2020-35654) could crash image-processing services on crafted files. Here's the fix and detection guidance.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
