Incident Analysis
3CX Desktop App: Anatomy of a Cascading Breach
How a Trading Technologies installer from 2022 poisoned the 3CX build pipeline in 2023, producing the first publicly confirmed cascading supply chain attack.
Jan 25, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDevSecOps
Chaos Engineering for Supply Chain Resilience: Breaking Your Build to Make It Stronger
Chaos engineering principles applied to the software supply chain reveal hidden dependencies, single points of failure, and degradation paths that only surface under stress.
Jan 25, 20265 min read
DevSecOps
What is a CI/CD Pipeline
A CI/CD pipeline automates code from commit to deployment—but SolarWinds, Codecov, and CircleCI show it's also a top supply-chain attack target.
Jan 25, 20266 min read
AppSec
Modern Command Injection Prevention: Beyond the Basics
Command injection remains in the OWASP Top 10 because developers keep making the same mistakes with new tools. Here is a modern prevention guide covering containers, serverless, and CI/CD.
Jan 25, 20266 min read
Open Source Security
PyPI malware campaigns targeting machine learning and dat...
PyPI malware ML packages have hit PyTorch and Ultralytics YOLO via dependency confusion and CI/CD compromise. What happened, and how to defend your ML supply chain.
Jan 25, 20269 min read
Startup Security
Startup Security at Growth Stage: Building Enterprise-Grade Programs
Post-Series B, your startup is becoming an enterprise. Security programs that worked for 30 engineers will not work for 300. Here is how to build security that scales with your ambitions.
Jan 25, 20265 min read
Container Security
Running Containers in Rootless Mode: A Practical Security Guide
Root in the container often means root on the host. Rootless mode breaks that assumption. Here is how to run Docker and Podman without root and why it matters more than you think.
Jan 25, 20267 min read
Industry Analysis
State of Software Supply Chain Security 2026
A senior-engineer view of where software supply chain security stands in 2026: what's changed, what's stuck, and where budgets, regulations, and attacker tactics converge.
Jan 25, 20269 min read
Open Source Security
npm supply chain attacks via malicious postinstall scripts
How a single postinstall hook in a compromised npm package can run malware at install time, real incidents from 2018-2025, and how to defend against it.
Jan 25, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.