Application Security
OWASP API Security Top 10 risks explained
The OWASP API Security Top 10 ranks BOLA, broken auth, SSRF, and 7 more API risks behind breaches like Optus and T-Mobile — explained with real incidents.
Jun 4, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
AI & LLM Governance for Software Development
Sonatype flags bad packages after the fact. Here's what AI governance for software development requires, and how Safeguard tracks models and output together.
Jun 4, 20268 min read
AppSec
OWASP Top 10 and XSS: Where Cross-Site Scripting Fits Now
In the OWASP Top 10, XSS is no longer its own category. As of the 2021 list it lives inside A03: Injection. Here is what changed, why, and how to defend against it.
Jun 4, 20265 min read
Security
GPLv2 vs GPLv3: A Practical Comparison for Developers
The real differences between GPLv2 and GPLv3 that affect how you ship software: patents, tivoization, license compatibility, and the security angle.
Jun 4, 20266 min read
Application Security
Implementing the OWASP Top 10 Proactive Controls
A field guide to the OWASP Top 10 Proactive Controls: what each control requires, real breach examples like Equifax, and how to implement them in CI/CD.
Jun 4, 20267 min read
Security
SFMC API Security: How to Integrate Marketing Cloud Safely
A security-focused guide to the Salesforce Marketing Cloud (SFMC) API: OAuth scopes, token handling, least-privilege packages, and protecting subscriber data.
Jun 4, 20266 min read
SBOM
Shadow Risks: Unmanaged and Unauthorized Dependencies
Shadow dependencies risk management is now core to SBOM strategy. See how unmanaged, unauthorized open source packages cause breaches Sonatype-style scans miss.
Jun 4, 20268 min read
Containers
Container Security Testing Methods, Compared
Image scanning, runtime monitoring, and configuration auditing all count as container security testing, but they catch different things at different stages — here's how to combine them.
Jun 4, 20265 min read
Application Security
What is SAST? Static Application Security Testing explained
SAST scans source code for vulnerabilities before deployment. Learn how it works, where it fits vs. DAST/SCA, its false-positive limits, and 2026 tooling.
Jun 4, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.