Incident Analysis
tj-actions/changed-files Compromise: What Happened
A March 2025 GitHub Action compromise rewrote every tagged version to leak secrets. Here is the timeline, attack chain, and what repos need to change.
Jan 14, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCloud Security
Preventing and detecting Azure service principal credenti...
How Azure service principal secrets leak through repos, pipelines, and IaC state files — and the detection, scoping, and rotation practices that stop a leak from becoming a breach.
Jan 14, 20268 min read
Vulnerability Analysis
GitLab Critical RCE (CVE-2022-2884): Remote Code Execution via GitHub Import
A critical vulnerability in GitLab's GitHub import feature allowed authenticated attackers to execute arbitrary code on the server. The flaw highlighted risks in platform migration features.
Jan 13, 20266 min read
How-To Guide
Setting Up Dependency Scanning on GitHub
A hands-on walkthrough for configuring automated dependency scanning in your GitHub repositories, from Dependabot alerts to custom CI workflows.
Jan 13, 20266 min read
Cloud Security
Infrastructure as Code Security: Scanning Terraform, CloudFormation, and Kubernetes Manifests
IaC scanning catches misconfigurations before they reach production. This guide covers tools, techniques, and integration patterns for Terraform, CloudFormation, and Kubernetes.
Jan 13, 20267 min read
Organizational Security
Building a Security Team from Scratch
A practical guide to hiring your first security engineers, defining roles, and building a security function that scales with your organization.
Jan 13, 20267 min read
Supply Chain Attacks
Malicious GitHub Commits: The Overlooked Supply Chain Attack Vector
Attackers can impersonate any committer on GitHub, inject malicious code through PRs, and exploit lax review processes. Here's the risk.
Jan 13, 20267 min read
Industry Guides
Software Supply Chain Security in Banking: A Practical Guide
Banks face unique software supply chain risks. This guide covers real threats, regulatory expectations, and what security teams should actually be doing.
Jan 13, 20267 min read
Supply Chain Security
Supply Chain Security for Government Agencies
Government agencies face unique software supply chain threats. Here's how federal and state organizations can protect critical infrastructure from compromise.
Jan 13, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.