Vulnerability Analysis
Mass assignment vulnerabilities explained
Mass assignment lets attackers write privileged fields like "role":"admin" via ordinary API calls. Learn how it works, real CVEs, and fixes.
Dec 5, 20257 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedTools
How deepfake fraud detection tools identify synthetic med...
A buyer's guide to real-time deepfake fraud detection tools: evaluation criteria, an honest comparison of six named vendors, and where Safeguard fits in.
Dec 5, 20258 min read
Vulnerability Analysis
GraphQL injection and introspection abuse explained
How GraphQL injection, introspection abuse, and alias-based DoS attacks expose APIs to data leaks—illustrated by the 2021 Peloton breach.
Dec 5, 20257 min read
Open Source Security
RubyGems 2019 Multi-CVE Disclosure: Directory Traversal v...
CVE-2019-8320 let malicious RubyGems packages delete arbitrary directories via symlinked gem decompression. Here's the impact, timeline, and how to remediate it.
Dec 5, 20258 min read
AI Security
CoSAI Releases Model Signing and Incident Response Frameworks
The Coalition for Secure AI published two operational frameworks in November 2025: Signing ML Artifacts and AI Incident Response. We unpack what each contains and how to adopt them.
Dec 4, 20257 min read
Vulnerability Analysis
JWT algorithm confusion / none-algorithm bypass explained
How attackers forge JWTs via RS256/HS256 key confusion and the alg:none bypass, with real CVEs, detection steps, and defenses.
Dec 4, 20257 min read
Open Source Security
RubyGems Escape Sequence Injection via Gem Name Output (C...
A look at CVE-2019-8321, the RubyGems escape sequence injection flaw in gem CLI output: affected versions, severity, and how to remediate it.
Dec 4, 20258 min read
Security
Hacking Software: What It Is and How Defenders Use It Legally
Hacking software is the category of programs used to test and break into systems. Used with authorization, it is how security teams find their own weaknesses first.
Dec 4, 20257 min read
Engineering
Reproducible Builds: Why Bit-for-Bit Identical Matters
If two builds of the same source produce different binaries, you cannot prove what you shipped. How determinism breaks, the flags that fix it, and why auditors care.
Dec 4, 20256 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.