Open Source Security
5 risks of using open source software
Five documented open source risks — from Log4Shell to the XZ Utils backdoor — with real incidents, dates, and CVEs, plus how Safeguard closes the gap.
May 9, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity
Rego Policy Language: How OPA Turns Rules Into Code
Rego is the declarative policy language behind Open Policy Agent. This guide explains how it works, where it fits in a security pipeline, and how to write policies you can trust.
May 9, 20266 min read
Security
How Much Does Black Duck Cost? A Guide to Black Duck Pricing
Black Duck pricing is quote-only and negotiated per codebase and team size. Here is what drives the cost, the ballpark figures teams report, and how to evaluate whether it fits your budget.
May 9, 20265 min read
Open Source Security
GPL vs MIT vs Apache: license security and compliance implications
Redis, Vizio, and Cisco show how GPL, MIT, and Apache 2.0 licenses create real legal and compliance exposure across your software supply chain.
May 9, 20267 min read
Open Source
dotenv npm: A Security Review and Safe Usage Guide
The dotenv npm package loads environment variables from a .env file into process.env. It is safe and widely used, but how you handle the file around it is where most mistakes happen.
May 9, 20266 min read
AI Security
Prompt injection attacks against AI coding/security tools
AI coding assistants like Copilot and Cursor can be hijacked by hidden text in files, comments, and packages. Here's how prompt injection malware works and how Safeguard detects it.
May 9, 20266 min read
AppSec
MySQL Injection Cheat Sheet: How to Detect and Stop SQLi
A defender's MySQL injection cheat sheet: the query patterns attackers probe for, how login bypass and UNION-based extraction work, and how to shut them down.
May 9, 20266 min read
Open Source Security
Building an SBOM that meets NTIA minimum elements
A field-by-field breakdown of NTIA's SBOM minimum elements, who's legally required to meet them in 2026, and why conformant fields don't guarantee real dependency coverage.
May 9, 20267 min read
Containers
Kubernetes runAsUser: How to Run Containers as a Non-Root User
What the Kubernetes runAsUser security context does, how to set it correctly, and the common mistakes that quietly leave pods running as root.
May 9, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.