Containers
Docker Ubuntu Image: How to Use It Securely and Keep It Slim
The Docker Ubuntu image is a fine base, but a naive Dockerfile ships a bloated, vulnerable container. Here is how to pin, slim, and scan it properly.
Jul 2, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
AI Security Software: A Buyer's Guide for 2026
The label 'AI security software' now covers two different markets — tools that secure AI systems, and security tools powered by AI. How to tell them apart, what to evaluate, and the questions that expose thin products.
Jul 2, 20266 min read
Vulnerability Analysis
Log4j Log4Shell vulnerability explained CVE-2021-44228
Log4Shell (CVE-2021-44228) let attackers gain RCE via a single logged string. Here's the CVSS/EPSS/KEV context, timeline, and how to remediate it.
Jul 2, 20267 min read
Security
Getting Value From a Wiz Demo: What to Test in the Security Graph
How to run a Wiz demo that tells you something real — connecting your own cloud, chasing attack paths and toxic combinations, and the questions that reveal fit.
Jul 2, 20266 min read
Application Security
GitHub Secret Protection deep dive: push protection, cust...
How GitHub Secret Protection's push protection, custom patterns, and validity checks actually work post-GHAS split, and where the coverage gaps still leave secrets exposed.
Jul 2, 20267 min read
Regulatory Compliance
ISO 27001:2022 Transition Deadline: The Approach
The October 31, 2025 ISO/IEC 27001:2022 transition deadline is weeks away. Here's what auditors will look for in Annex A controls, statements of applicability, and evidence packs.
Jul 2, 20265 min read
AppSec
Skill Scanner: How It Works and What to Use
What a skill scanner does, why AI agent skills and voice-assistant skills need scanning, and how to evaluate one for your pipeline.
Jul 2, 20266 min read
Software Supply Chain Security
PyPI typosquatting malicious packages
PyPI typosquatting tricks developers into installing malicious lookalike packages via one-letter typos. Real incidents, attack patterns, and defenses inside.
Jul 2, 20265 min read
Application Security
GitHub Code Security and CodeQL SAST scanning explained
GitHub split Advanced Security into Code Security and Secret Protection in 2025. Here's how CodeQL SAST actually works, what it misses, and how Safeguard fills the supply-chain gap.
Jul 2, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.