SecOps
Vulnerability Scanning: A Quick Reference
A fast reference for what a vuln scan actually checks, the different scan types, and how often each should run — for engineers who need the answer, not the textbook.
Jun 6, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Building trust in AI-assisted software development
AI writes 30-50% of new code at many shops now, and 45% of it ships with security flaws. Here's how to build real trust in that pipeline.
Jun 6, 20266 min read
AI Security
Vulnerability Prioritization in the AI Era
CVSS scores can't keep pace with AI-generated code and 40,000+ annual CVEs. Here's why Sonatype's component-level model falls short and what real prioritization requires.
Jun 6, 20268 min read
Open Source
react-hook-form npm: A Security Review and Safe Usage Guide
The react-hook-form npm package is a dependency-free form library with a clean security record. The risk is not the library itself but how you validate and handle the data it collects.
Jun 6, 20266 min read
Security
How Can a DevOps Team Take Advantage of Artificial Intelligence?
A DevOps team takes advantage of artificial intelligence by using it where signal is buried in noise — triaging alerts, prioritizing vulnerabilities, and drafting fixes. Here is where it pays off and where it does not.
Jun 6, 20266 min read
AI Security
Cursor's AI security agents: what they get right and what's missing
Cursor's Bugbot and MCP agents catch real bugs, but CurXecute and MCPoison show they open new attack surfaces SCA tools never had to face.
Jun 6, 20266 min read
AppSec
Source Code Security Scanning Programs That Scale
A source code security scanning program that works for 20 repos usually breaks at 200 — here's how to design one that scales with the number of teams, not just the number of scans.
Jun 6, 20266 min read
SBOM
Software Dependency Cooldown Policies
A dependency cooldown policy delays new package versions for a set window so the ecosystem can catch malicious releases before they reach your build pipeline.
Jun 6, 20267 min read
AppSec
Mobile Application Security Assessment: How It's Actually Done
What a mobile application security assessment actually involves, from static binary analysis through dynamic testing on real devices, and where it differs from a web app pen test.
Jun 6, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.