Incident Analysis
Hugging Face Token Exposure 2024 Analysis
Researchers found thousands of valid Hugging Face API tokens in public code and models. Analysis of the 2024 exposures and what they mean for ML supply chain.
Mar 21, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity
Hacking Skills: What Ethical Hackers Actually Need to Learn
The hacking skills that matter for a security career are less about flashy exploits and more about networking, systems, code, and disciplined methodology. Here is the real list.
Mar 20, 20267 min read
Compliance
The MIT License, Summarized: What It Permits and Requires
A plain-English MIT license summary: the one condition it imposes, the freedoms it grants, and the compliance step teams still manage to miss.
Mar 20, 20265 min read
Incident Analysis
Ascension Health Black Basta Ransomware: 5.6M Patients Impacted
Black Basta encrypted Ascension's network on May 8, 2024 via a malicious file downloaded by an employee, diverting ambulances across 140 hospitals and ultimately notifying 5.6 million patients.
Mar 20, 20266 min read
SecOps
Tools in Cyber Security: A Starter Map by Category
The tools in cyber security span network defense, application security, identity, and data protection, and the fastest way to get oriented is a map by category rather than a vendor list.
Mar 20, 20265 min read
Open Source
npm run: How Scripts Work and How to Use Them Safely
npm run executes the scripts defined in your package.json. Here is how it resolves commands, the lifecycle hooks that run automatically, and the supply-chain risks to watch.
Mar 20, 20266 min read
Security
Nginx and CVE-2023-44487: How to Fix HTTP/2 Rapid Reset
CVE-2023-44487, the HTTP/2 Rapid Reset attack, is a protocol-level DoS. Nginx resists it with default settings, but a loose keepalive config can still be abused. Here's the fix.
Mar 20, 20266 min read
DevSecOps
Log4j Maven Dependency: How to Find, Fix, and Pin It Safely
A practical guide to the Log4j Maven dependency: how to detect log4j-core in your tree, why 2.17.1 is the version to target, and how to pin it for good.
Mar 20, 20265 min read
Vulnerability Analysis
SonicWall SMA 1000 Zero-Day: CVE-2025-23006 Pre-Auth RCE
SonicWall disclosed CVE-2025-23006, a critical deserialization vulnerability in its SMA 1000 series gateways that was actively exploited as a zero-day before patches were available.
Mar 20, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.