Architecture
Griffin Agent Loop: Design Decisions
The design rationale behind Griffin, Safeguard's triage agent — how the loop is structured, why we bounded reasoning depth, and how tool calls stay auditable.
Feb 2, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedThreat Intelligence
Salt Typhoon Telecom Supply Chain Campaign 2024
Salt Typhoon's 2024 intrusions into U.S. telecoms reframed supply chain risk as a routing and lawful-intercept problem. Here is what the campaign looked like from a defender's seat.
Feb 2, 20267 min read
Application Security
What is Abstract Syntax Tree (AST) Analysis
AST analysis parses code into a tree to catch what regex scanning misses — here's how it works, its limits, and how reachability fixes the gap.
Feb 2, 20266 min read
Industry Analysis
Ruby deserialization vulnerabilities: Marshal.load, YAML....
A decade of Ruby CVEs — from CVE-2013-0156 to CVE-2022-32224 — shows how Marshal.load and YAML.load turn untrusted input into remote code execution.
Feb 2, 20268 min read
Application Security
What is Semantic Code Analysis
Semantic code analysis traces how data actually flows through code to find real vulnerabilities — cutting false positives that plague pattern-matching SAST tools.
Feb 2, 20265 min read
Open Source Security
Auditing Ruby dependencies for known CVEs with bundler-audit
A step-by-step bundler-audit tutorial for scanning Ruby gems against known CVEs, patching vulnerable dependencies, and enforcing the check in CI.
Feb 2, 20267 min read
DevSecOps
What is a Security Gate
A security gate blocks a build or deploy the moment it fails a policy check. Here's what gates actually check, where to place them, and why most fail.
Feb 2, 20266 min read
Open Source Security
Case study: RubyGems account takeover incidents and their...
A look at real RubyGems account takeover incidents, including the rest-client hijack, and what they reveal about Ruby supply chain risk.
Feb 2, 20268 min read
Vulnerability Analysis
SonicWall SMA 1000 CVE-2025-23006 Pre-Auth RCE
CVE-2025-23006 is a pre-auth deserialization RCE in SonicWall SMA 1000. Exploit chain, detection signals, and appliance hardening.
Feb 2, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.