Concepts
What Is a Security Advisory
A security advisory is an official notice that a product has a security flaw, plus how to fix it. Here is what advisories contain, who issues them, and how to act on one.
Jul 6, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Analysis
VMware vCenter (CVE-2021-21985) Explained: The vSAN Plugin RCE
CVE-2021-21985 is a CVSS 9.8 unauthenticated RCE in VMware vCenter Server's vSAN Health plugin, enabled by default on every install. Here is how it works and the patched builds to run.
Jul 6, 20266 min read
Concepts
Understanding Open Source Security Risk
Open source powers nearly every modern application, but the code you inherit brings risks you did not write. This guide explains where open source risk comes from, how it reaches your product, and how to manage it without abandoning the ecosystem.
Jul 6, 20266 min read
Buyer's Guides
Trivy vs Grype: A Neutral Open-Source Scanner Comparison for 2026
Trivy and Grype are both free, open-source vulnerability scanners loved by engineers, but they differ in scope and philosophy. An honest side-by-side, plus where a managed third option fits.
Jul 6, 20266 min read
Threat Research
Transitive Dependency Risk Explained: The Code You Never Chose
Transitive dependencies are the packages your dependencies pull in, and they make up most of your codebase. Here is why they are risky and how to manage them.
Jul 6, 20266 min read
Buyer's Guides
Top SAST Auto-Fixing Tools in 2026: An Honest Buyer's Guide
A balanced 2026 comparison of SAST tools that auto-fix findings — GitHub Copilot Autofix, Semgrep, Snyk, SonarQube, Mobb, Pixee — with honest tradeoffs and where Safeguard fits.
Jul 6, 20266 min read
DevSecOps
Threat Modeling for Developers: A Lightweight Practical Guide
Threat modeling doesn't need a two-day workshop. A developer-friendly 2026 guide to modeling threats with the four-question framework and STRIDE — fast enough to run on a feature branch.
Jul 6, 20265 min read
Security Guides
Spring Framework Security Guide (2026)
Spring Framework is the backbone of enterprise Java — and the source of Spring4Shell plus a steady stream of path-traversal and SSRF CVEs. Here is how to run it safely in 2026.
Jul 6, 20266 min read
Buyer's Guides
Sonatype Nexus Alternatives in 2026: An Honest Buyer's Guide
A balanced comparison of the leading Sonatype Nexus alternatives in 2026 — JFrog, Snyk, Mend, Black Duck, Cloudsmith, and Safeguard — with candid pros, cons, and a framework for choosing.
Jul 6, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.