Vulnerability Analysis
XML signature wrapping attacks explained
XML signature wrapping lets attackers forge signed SOAP and SAML messages without breaking the signature. Here's how the attack works and how to stop it.
Dec 4, 20257 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source Security
RubyGems Escape Sequence Injection via Crafted API Respon...
CVE-2019-8322 is a RubyGems flaw where crafted API responses could inject terminal escape sequences, spoofing gem output. Here's what to know and how to fix it.
Dec 4, 20258 min read
Vulnerability Analysis
SSRF via webhooks explained
Webhook SSRF turns a trusted callback feature into an internal network foothold. Here is how the attack works, real incidents, and how to actually fix it.
Dec 4, 20257 min read
Open Source Security
RubyGems Escape Sequence Injection in Gem Owner Command (...
CVE-2019-8323 shows how RubyGems' gem owner command echoed unsanitized API response data to the terminal, enabling escape sequence injection attacks.
Dec 4, 20257 min read
Vulnerability Analysis
Kubernetes RBAC misconfiguration explained
RBAC misconfigurations like wildcard rules and default service account bindings have powered real cluster takeovers, from CVE-2018-1002105 to Siloscape.
Dec 4, 20256 min read
Open Source Security
RubyGems Malicious Gem Arbitrary Code Execution via Missi...
CVE-2019-8324 let a malicious RubyGems package run arbitrary code at install time via a crafted multi-line gem name evaluated during the preinstall check.
Dec 4, 20257 min read
AppSec
How to Read a Security Scanning Report Without Drowning in Noise
A security scanning report lists what a scanner found across your code, dependencies, and infrastructure. Here's how to read one, prioritize it, and act on what matters.
Dec 3, 20256 min read
Open Source
Is the mammoth npm Package Safe? A DOCX Converter Security Review
The mammoth npm package converts .docx files to HTML, but CVE-2025-11849 showed how a crafted document can read files off your server. Here is what to check.
Dec 3, 20256 min read
Open Source
eslint-plugin-import and import-helpers: Order Your Imports, Catch Mistakes
eslint-plugin-import-helpers gives you fully configurable import ordering; eslint-plugin-import catches the real bugs — unresolved paths, phantom dependencies, cycles. Most codebases want both.
Dec 3, 20257 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.