DevSecOps
What is a CI/CD Pipeline
A CI/CD pipeline automates code from commit to deployment—but SolarWinds, Codecov, and CircleCI show it's also a top supply-chain attack target.
Jan 25, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source Security
PyPI malware campaigns targeting machine learning and dat...
PyPI malware ML packages have hit PyTorch and Ultralytics YOLO via dependency confusion and CI/CD compromise. What happened, and how to defend your ML supply chain.
Jan 25, 20269 min read
Vulnerability Analysis
Windows LDAP LSASS CVE-2024-49113 (LDAPNightmare)
CVE-2024-49113 crashes LSASS over LDAP referrals and pairs with CVE-2024-49112 for RCE. Exploit chain, detection, and domain controller hardening.
Jan 25, 20267 min read
Open Source Security
npm supply chain attacks via malicious postinstall scripts
How a single postinstall hook in a compromised npm package can run malware at install time, real incidents from 2018-2025, and how to defend against it.
Jan 25, 20267 min read
Industry Analysis
State of Software Supply Chain Security 2026
A senior-engineer view of where software supply chain security stands in 2026: what's changed, what's stuck, and where budgets, regulations, and attacker tactics converge.
Jan 25, 20269 min read
AI Security
Domain-Adapted LLMs For Vulnerability Detection in 2026
Domain adaptation has quietly become the default for LLM-assisted vulnerability detection. A look at what works in 2026, what does not, and what teams should plan for next.
Jan 24, 20266 min read
AI Security
Griffin AI vs GPT-4o: Security Limits Exposed
GPT-4o is an excellent general-purpose model. Security workflows are a specialty, and specialty work exposes the limits of general intelligence.
Jan 24, 20267 min read
AI Security
Regression Testing on Fixes: Griffin AI vs Mythos
A remediation PR is only useful if it does not break anything else. Griffin AI runs targeted regression before opening; Mythos-class tools usually do not.
Jan 24, 20266 min read
AI Security
Prompt Injection as a Supply Chain Risk in 2026
Prompt injection stopped being an LLM curiosity the moment agents started committing code. It is now a software supply chain risk and should be modeled as one.
Jan 24, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.