Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2018-16487 let attackers pollute Object.prototype through lodash's merge, mergeWith, and defaultsDeep — a bypass of an earlier fix, patched in 4.17.11.
CVE-2020-8203 lets attackers pollute JavaScript's Object prototype via lodash's zipObjectDeep function, risking DoS or RCE in downstream apps.
Docker packages an application and everything it needs into a portable container that runs the same everywhere. Understanding that model is the first step to securing it.
The Snyk login flow supports SSO, identity-provider integration, and CLI token auth. Here is how each works and how to keep your Snyk account access secure.
Zod is a well-maintained TypeScript validation library that is itself a security asset, if you put it at your trust boundaries. Here is a review and how to use it right.
JavaScript code injection happens when an application treats untrusted input as executable code. This guide explains the attack class conceptually and focuses on detection and prevention.
Infrastructure as Code (IaC) security is the practice of scanning and hardening the machine-readable files that define your cloud infrastructure — before they provision anything. Here's how it catches misconfigurations at the source.
CVSS alone is a poor priority signal. A 2026 guide to prioritizing vulnerabilities with EPSS, CISA KEV, SSVC, and reachability — so you fix the few that are exploitable, not the thousands that aren't.
You would never run an unknown binary from a stranger, but teams pull unknown model weights off public hubs every day. Loading them can be code execution — and that is only the most obvious link in the chain.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
