Compliance
How to meet SOC 2 audit logging requirements
A step-by-step guide to meeting SOC 2 audit logging requirements: what to log, retention, access controls, alerting, and how to verify your controls before an audit.
Feb 12, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCase Studies
Netflix's Open-Source Security Approach
How Netflix manages security across hundreds of open-source projects and thousands of internal dependencies while maintaining the velocity that streaming demands.
Feb 11, 20267 min read
Open Source Security
npm audit vs pnpm audit vs yarn audit
Three audit tools, three philosophies, three blind spots. A ground-level comparison of how npm, pnpm, and yarn surface vulnerabilities, and where each one leaves you exposed.
Feb 11, 20267 min read
Application Security
React Application Security Guide
Securing React applications from XSS, dependency vulnerabilities, and common frontend attack patterns.
Feb 11, 20265 min read
Industry Guides
Manufacturing OT Software Supply Chain: Securing the Factory Floor
Manufacturing OT systems depend on software supply chains that most security teams don't monitor. Here's how to extend supply chain security to the factory floor.
Feb 11, 20267 min read
Incident Analysis
Microsoft Breached by Midnight Blizzard: Russian Hackers Read Executive Emails
In January 2024, Microsoft disclosed that the Russian state-sponsored group Midnight Blizzard had been reading emails of senior executives and security team members since November 2023, using a password spray attack against a legacy test account.
Feb 11, 20267 min read
Threat Intelligence
Midnight Blizzard Breaches Microsoft: What the Exchange Online Attack Means for Everyone
Russian state actors compromised Microsoft executive email accounts through a password spray attack on a legacy test tenant. The breach exposed how identity misconfigurations cascade.
Feb 11, 20266 min read
Tool Reviews
Veracode SCA: Mature Application Security Meets Dependency Scanning
An overview of Veracode's SCA capabilities within their broader application security platform, covering vulnerability prioritization, agent-based scanning, and enterprise features.
Feb 11, 20265 min read
AI Security
Container-Specific Vulnerability Management Tools, Compared
A field guide to container-specific vulnerability management tools: what Trivy, Grype, Clair, Docker Scout, and Anchore actually catch, and where each falls short.
Feb 11, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.