DevSecOps
Node.js vm Module Security: Why It Is Not a Sandbox
The Node.js vm module runs code in a separate V8 context, but it is not a security sandbox. Here is why untrusted code can escape it and what to use instead.
May 25, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
An Engineering Guide to AI Bill of Materials (AIBOM)
An AIBOM extends the SBOM to models, datasets, and prompts. What goes in one, how CycloneDX 1.6 encodes it, and how to generate it in CI without a documentation project.
May 25, 20266 min read
Open Source
Archiver npm: A Security Review and Safe-Usage Guide
The archiver npm package builds zip and tar streams cleanly, but the real risks are on the extraction side and in its dependency tree. Here is how to use it safely.
May 25, 20265 min read
DevSecOps
How to Choose a Python Code Checker for Secure Code
A Python code checker is more than a linter. Here is how the layers fit together, which open-source tools do what, and where online checkers help and hurt.
May 25, 20266 min read
AppSec
jwks-rsa: Verifying JWTs Against a JWKS Endpoint Safely
The jwks-rsa npm library fetches signing keys from a JWKS endpoint so you can verify JWTs correctly. Here is how to wire it up without introducing key-confusion or availability bugs.
May 25, 20267 min read
Application Security
10 Spring Boot security best practices
Ten concrete Spring Boot security practices, with real CVEs, config flags, and file paths, to close the gaps attackers actually exploit.
May 25, 20267 min read
Security
Zombie APIs: The Forgotten Endpoints That Put You at Risk
A zombie API is a forgotten, undocumented endpoint that still runs and still accepts traffic. Here is why they are dangerous and how to find and kill them.
May 25, 20266 min read
Application Security
Best application security testing providers ranked
Mend.io built its reputation on SCA and open source dependency scanning. Here's how Safeguard's supply chain security approach compares.
May 25, 20267 min read
AppSec
OWASP 2019: The API Security Top 10 That Reshaped API Testing
The OWASP release everyone means by 2019 is the first API Security Top 10, which put authorization flaws — not injection — at the center of API risk.
May 25, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.