AI Security
Securing AI coding assistants (Claude Code, Copilot, etc.)
AI coding assistants like Claude Code and Copilot introduce new supply chain risks. Here's what's actually going wrong and how to secure your pipeline.
Jun 24, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Prompt Injection Examples: Attacks Seen in the Wild
From hidden text in resumes to poisoned web pages that hijack AI browsing agents, prompt injection has moved from research demos to real incidents. Here are the patterns and what actually blunts them.
Jun 24, 20266 min read
Concepts
What Is the NVD (National Vulnerability Database)?
The NVD is the U.S. government's enrichment layer on top of the CVE List, adding CVSS scores, CWE classifications, and affected-configuration data. Here is how it works and where it falls short.
Jun 24, 20266 min read
Guides
How to Secure a Monorepo Without Slowing Every Team Down
Monorepo security fails when every check runs on every commit. Path-filtered CI, CODEOWNERS, per-workspace scanning, and merge queues fix that.
Jun 24, 20266 min read
Vulnerability Analysis
CVE-2020-17530: Forced OGNL evaluation RCE in Apache Struts2
CVE-2020-17530 lets attackers achieve unauthenticated RCE in Apache Struts2 via forced OGNL evaluation. Here's the scope, timeline, and how to remediate it.
Jun 24, 20267 min read
Container Security
Container configuration drift detection at runtime
Container images pass CI clean, but running containers drift within hours via exec sessions, sidecars, and webhooks. Here's how to detect it at runtime.
Jun 24, 20267 min read
Cloud Security
Code-to-cloud security (CNAPP-style end-to-end protection)
Checkmarx scans code and pipelines well, but stops short of live cloud context. Here is what code-to-cloud security actually requires, with real breach examples.
Jun 24, 20268 min read
Security
DevOps Measurements: Metrics That Actually Matter
The DevOps measurements worth tracking tie delivery speed to stability and security. Here are the ones that change decisions, not just dashboards.
Jun 24, 20265 min read
Supply Chain
SCA Scanning: What It Catches in Practice
SCA scanning finds known CVEs in your open-source dependencies and license conflicts you didn't know you'd agreed to — here's exactly what a scan catches, in order of how often it actually matters.
Jun 24, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.