Build Security
Software Provenance: An End-to-End Guide
Provenance answers where software came from and how it was built. Here is how to implement end-to-end provenance tracking from source to deployment.
Jul 10, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIncident Analysis
Dependency confusion attacks against major tech companies
A look at the dependency confusion attacks that hit Apple, Microsoft, PayPal, and PyTorch — and why the technique still works against top engineering orgs.
Jul 10, 20267 min read
AppSec
Mobile Security Testing: OWASP MAS in Practice
OWASP MAS turns mobile app security from ad-hoc pentests into a program: what the eight MASVS control groups cover, how MASTG test cases work, and how to fit it all into CI.
Jul 10, 20266 min read
Industry Analysis
Improper Inventory Management: Shadow and Zombie APIs
Undocumented shadow APIs and forgotten zombie endpoints are quietly expanding attack surface. Here's why inventory gaps cause breaches like T-Mobile and Optus.
Jul 10, 20267 min read
Security
CVE-2023-36414: The Azure Identity SDK RCE You Should Patch
CVE-2023-36414 is a remote code execution flaw in the Azure Identity SDK for .NET. Here is how the injection works and which version closes it.
Jul 10, 20265 min read
Buyer's Guides
Best zero trust architecture implementation tools
A vendor-neutral buyer's guide to zero trust architecture tools: what to evaluate, plus honest strengths and limits of six leading platforms compared.
Jul 10, 20268 min read
AppSec
Web Application Scanning: Tools and Methods Compared
Web application scanning ranges from free automated crawlers to full authenticated DAST pipelines — here's how the methods differ and when each is enough.
Jul 10, 20265 min read
Incident Analysis
GitHub Actions supply chain risk report
A look at the tj-actions/changed-files compromise and the broader trend of GitHub Actions supply chain attacks — and what security teams should do now.
Jul 10, 20267 min read
Industry Analysis
Broken Authentication in API Endpoints
Broken authentication in API endpoints drove breaches at T-Mobile, Optus, and Peloton. Here's why it keeps happening and how to catch it before attackers do.
Jul 10, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.