Vendor Comparison
Semgrep Cloud vs GitHub CodeQL: comparing SAST engines in 2026
How Semgrep Cloud and CodeQL compare on rule authoring, language coverage, performance, and pull request ergonomics for static analysis programs.
May 13, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain Attacks
VS Code marketplace incident postmortem: what 2023-2024 actually taught us
Between 2023 and 2024 the VS Code Marketplace saw a string of typosquat, hijack, and impersonation incidents that shaped Microsoft's eventual hardening response. This is a composite postmortem of what happened, what changed, and what is still broken in 2026.
May 13, 20268 min read
Open Source
The bootloader supply chain: what an OS vendor controls versus inherits
Between firmware and the kernel sits a thin layer of code that almost no one audits and almost everyone trusts. Understanding the supply chain behind shim, GRUB, and u-boot is the difference between owning your boot path and renting it.
May 13, 20267 min read
Buyer's Guides
npm audit isn't enough: what it misses
npm audit catches known CVEs and stops there. It misses malicious packages, install scripts, and typosquats -- the threats actually landing in npm today.
May 13, 20268 min read
Compliance
FTC Section 5 and software security: how 'unfair practices' became a supply chain doctrine
The Federal Trade Commission has spent the last several years building a software-security enforcement theory under Section 5. Drizly, SolarWinds, and Henry Schein each contributed pieces of the framework.
May 13, 20268 min read
DevSecOps
Flux CD vs Argo CD: Security Comparison for 2026
A security-focused comparison of Flux 2.5 and Argo CD 3.1: trust models, multi-tenancy, secret handling, signature verification, and the operational differences.
May 13, 20266 min read
Vulnerability Management
Linguistic Lumberjack: lessons from Fluent Bit CVE-2024-4323
Tenable's Linguistic Lumberjack flaw in Fluent Bit's monitoring API was a heap corruption with a wide blast radius because observability sidecars are everywhere and rarely inventoried.
May 13, 20266 min read
Containers
Dockerizing Node.js and PHP Apps: A Practical Guide
Writing a node js dockerfile and learning how to dockerize php application deployments both hinge on the same handful of decisions — base image, layer order, and what you leave out of the final image.
May 13, 20265 min read
Security
CVE-2022-42004: The jackson-databind DoS Explained
CVE-2022-42004 is a denial-of-service flaw in jackson-databind where deeply nested arrays exhaust resources during deserialization. Here is who is affected and how to fix it.
May 13, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.