Open Source Security
Transitive dependency vulnerabilities explained
A vulnerability three layers deep in your dependency graph is still your problem. Here's how transitive flaws like Log4Shell hide, spread, and get fixed.
Apr 30, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIndustry Analysis
Open source security audits: what they cover
What an open source security audit actually covers versus routine SCA scanning, the frameworks that define it, real costs and timelines, and how Aikido Security's approach compares.
Apr 30, 20268 min read
Security
Fix My Java Code: A Practical Guide to Finding and Fixing Security Bugs
"Fix my Java code" usually means a security or dependency problem. Here is a repeatable way to find the real fault, fix it, and stop it from returning.
Apr 29, 20266 min read
Security
CVE-2023-36665: The protobuf.js Prototype Pollution Vulnerability Explained
CVE-2023-36665 is a critical prototype pollution flaw in protobuf.js that can lead to remote code execution. Here is how it works and how to fix it fast.
Apr 29, 20265 min read
DevSecOps
Git Repository URL: How to Find, Copy, and Change It Safely
A Git repository URL is the address Git uses to fetch and push code. Here is how to get your repository URL from the command line and GitHub, plus the security details that matter.
Apr 29, 20266 min read
Security
What Gartner Says About DevSecOps: Tools, Trends, and How to Read the Guidance
Gartner's DevSecOps research shapes a lot of security budgets. Here is how to interpret the guidance without buying every category on the map.
Apr 29, 20265 min read
Security
JavaScript Exploits Explained: How They Work and How to Stop Them
A practitioner's tour of the JavaScript exploit classes that actually break production apps — prototype pollution, XSS, and malicious dependencies — with detection and fixes.
Apr 29, 20267 min read
Open Source
pdfjs-dist on npm: Security Review and Safe Usage
The pdfjs-dist npm package renders PDFs in the browser, but CVE-2024-4367 allowed arbitrary JavaScript execution from a malicious PDF before 4.2.67. Here is what to check.
Apr 29, 20265 min read
AI Security
PyTorch CVE-2025-32434: weights_only=True No Longer Safe
A critical PyTorch RCE bypassed the safety property of torch.load(weights_only=True). We analyze the bug and explain why safetensors should now be the default.
Apr 29, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.