Incident Analysis
Shai-Hulud self-propagating npm worm campaign
Inside Shai-Hulud, the self-propagating npm worm that hijacked publish tokens to auto-infect hundreds of packages across the JavaScript ecosystem.
Jul 12, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainers
K8s Admission Controllers: Enforcing Policy at the Kubernetes API
A k8s admission controller intercepts every request to the API server and can validate or mutate it, making it the natural enforcement point for security policy.
Jul 12, 20266 min read
Security
Buffer Overflow Attack: How It Works and How to Prevent It
A buffer overflow attack overwrites memory past a buffer's bounds to corrupt data or hijack execution. Here's how it works conceptually and the defenses that stop it.
Jul 12, 20266 min read
Vulnerabilities
App Vulnerability Classes: A Field Guide
Not every app vulnerability behaves the same way — this field guide groups the common web vulnerabilities by root cause so triage and prevention actually map to something repeatable.
Jul 11, 20265 min read
Industry Analysis
Unrestricted Resource Consumption in APIs
API4:2023 shows how a single unbounded request—GraphQL depth, a ReDoS regex, an unthrottled upload—can take down an API or run up a cloud bill.
Jul 11, 20267 min read
AppSec
Black Box Fuzzing, Explained
Black box fuzzing throws malformed input at a running application with zero knowledge of its internals, and it still finds crashes and memory bugs white box testing misses — here's how it works and where it fits in a security program.
Jul 11, 20266 min read
Vulnerability Management
Best bug bounty and vulnerability disclosure platforms
A practical buyers guide to bug bounty platforms and vulnerability disclosure program software, comparing HackerOne, Bugcrowd, Intigriti, YesWeHack, and more.
Jul 11, 20268 min read
AppSec
ZAP Scanner: How OWASP ZAP Works and When to Use It
ZAP is the most widely used free DAST scanner. Here is how its spider, passive, and active engines work, where it fits in CI, and its honest limits.
Jul 11, 20267 min read
Incident Analysis
lottie-player npm supply chain compromise
A phishing-driven npm token takeover pushed a crypto wallet drainer into lottie-player, hitting 94K weekly downloads before LottieFiles shipped a fix.
Jul 11, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.