Buyer's Guides
Best Terraform security and compliance tools
A practical, no-hype comparison of Terraform security tools — Checkov, tfsec/Trivy, Terrascan, Sentinel, Snyk IaC, and more — plus how Safeguard fits in.
Nov 16, 20258 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Response
CVE-2025-64446 in Fortinet FortiWeb: Patch Posture & SBOM Response
FortiWeb path traversal + RCE scored CVSS 9.1 and entered CISA KEV after months of targeted exploitation. Defender playbook for the WAF emergency.
Nov 15, 20257 min read
Open Source Security
Malicious NuGet packages targeting .NET developers
A fresh wave of malicious NuGet packages is hitting .NET developers via typosquatting, MSBuild-triggered code, and IL weaving. Here's what's happening and how to respond.
Nov 15, 20257 min read
Buyer's Guides
Best cloud security posture management (CSPM) tools
A practical buyer's guide to CSPM tools: evaluation criteria that matter, a fair comparison of six leading vendors, and where supply chain security fits in.
Nov 15, 20258 min read
AI Security
LLM Misinformation: Security Risks of Hallucinated Outputs
LLM hallucinations aren't just AI trivia — they invent packages attackers squat on, fake CVEs, and false advisories that have already cost real companies real money.
Nov 15, 20258 min read
Open Source Security
.NET deserialization vulnerability landscape
A look at the .NET deserialization vulnerability landscape — from the 2025 ASP.NET machine key crisis to BinaryFormatter's retirement and Telerik exploits.
Nov 15, 20257 min read
Cloud Security
Best cloud workload protection platforms (CWPP)
An honest, no-hype comparison of leading cloud workload protection platforms — evaluation criteria, real vendor tradeoffs, and where supply chain security fits in.
Nov 15, 20257 min read
AI Security
LLM Unbounded Consumption: Resource Exhaustion Attacks
How attackers exploit token-based pricing and growing context windows to exhaust LLM compute and inflate cloud bills — and the concrete limits that stop them.
Nov 15, 20259 min read
Open Source Security
NuGet typosquatting campaign report
Four disclosed NuGet typosquatting campaigns since 2024 reveal a shift toward patient, audience-specific attacks — from ICS time bombs to wallet-draining homoglyphs.
Nov 15, 20257 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.