Application Security
Argument injection in Git and Mercurial CLI wrappers
A branch name like --upload-pack=/bin/sh isn't a string to Git — it's a flag. CVE-2017-1000117 and CVE-2017-1000116 show why that distinction matters.
Jul 10, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
A primer on the OWASP API Security Top 10 and how to test for it
The OWASP API Security Top 10 dropped Injection entirely in its 2023 update and added SSRF — most REST and GraphQL teams still test for the old list.
Jul 10, 20267 min read
Application Security
How to Discover Shadow and Undocumented APIs Before Attackers Do
A single undocumented API endpoint exposed 10 million Optus records in 2022. Here's how to find shadow APIs in production and assess their real exposure.
Jul 10, 20266 min read
AI Security
AI Code Generation: An Evaluation Framework for Gating Output Before Merge
NYU researchers found security weaknesses in ~40% of Copilot-generated programs. Here's how to gate AI code before it ever reaches main.
Jul 10, 20267 min read
AI Security
Least-privilege scoping for AI agents with write access to code, CI, and cloud
OWASP's 2025 LLM Top 10 names Excessive Agency a top risk; a single over-scoped CI token already dumped secrets from 23,000+ repos in 2025.
Jul 10, 20268 min read
Incident Analysis
Docker Hub cryptojacking campaign analysis
Safeguard tracked a six-week Docker Hub cryptojacking campaign using 41 trojanized images, delayed payloads, and base-image laundering to evade scanners.
Jul 10, 20267 min read
Industry Analysis
Hidden Functionality and Undocumented API Endpoints
Undocumented API endpoints and hidden functionality sit outside vendor documentation entirely — here's where they come from, why attackers find them first, and how to detect them.
Jul 10, 20267 min read
Buyer's Guides
Best AI and LLM generated code security scanning tools
An honest buyer's guide to AI generated code security scanning tools: what to evaluate, how six real vendors stack up, and where they fall short.
Jul 10, 20268 min read
Incident Analysis
chalk and debug npm package compromise incident
A phished maintainer account led to a malicious npm publish of chalk, debug, and 16 related packages, exposing a crypto-clipper to billions of weekly downloads.
Jul 10, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.