AppSec
DAST Tools for DevSecOps Teams
The best DAST tools for DevSecOps teams run inside CI/CD rather than as a separate pre-launch step, and Gartner's own analysis of the DAST market backs that shift as the defining trend.
May 13, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedTools
Trivy Operator v0.30: Kubernetes Field Review
Trivy Operator hit v0.30 in early 2026 and the underlying Trivy v0.70 engine landed in April. We benchmarked the combo on a 60-node multi-tenant cluster.
May 13, 20267 min read
AI Security
Defending LLM agents against confused-deputy attacks on their tool privileges
An LLM agent with tools is a deputy that holds privileges its users do not. Attackers exploit that gap by tricking the agent into using those privileges on their behalf — here is how to design defenses that hold up.
May 13, 20268 min read
Industry Insights
State and local government software supply chain in 2026
StateRAMP, election infrastructure, court case management, and the budget-versus-risk gap that defines software supply chain security for state and local agencies.
May 13, 20267 min read
AppSec
What SCA Means in Security (Software Composition Analysis)
The SCA security meaning explained: what software composition analysis is, how it differs from SAST and DAST, and why it matters for the open source in your code.
May 13, 20266 min read
Cloud Security
GCP Cloud Functions and Cloud Run buildpacks: the third-party supply chain in 2026
Buildpack dependency surface plus Cloud Build's default service account creates a blast radius most teams underestimate. Here is what to harden in 2026.
May 13, 20267 min read
Vendor Comparison
Semgrep Cloud vs GitHub CodeQL: comparing SAST engines in 2026
How Semgrep Cloud and CodeQL compare on rule authoring, language coverage, performance, and pull request ergonomics for static analysis programs.
May 13, 20267 min read
Supply Chain Attacks
VS Code marketplace incident postmortem: what 2023-2024 actually taught us
Between 2023 and 2024 the VS Code Marketplace saw a string of typosquat, hijack, and impersonation incidents that shaped Microsoft's eventual hardening response. This is a composite postmortem of what happened, what changed, and what is still broken in 2026.
May 13, 20268 min read
Open Source
The bootloader supply chain: what an OS vendor controls versus inherits
Between firmware and the kernel sits a thin layer of code that almost no one audits and almost everyone trusts. Understanding the supply chain behind shim, GRUB, and u-boot is the difference between owning your boot path and renting it.
May 13, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.