Vulnerability Analysis
Lodash prototype pollution vulnerabilities explained
A breakdown of lodash's prototype pollution CVEs (CVE-2018-3721, CVE-2019-10744, CVE-2020-8203), their impact, and concrete remediation steps.
May 2, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCase Studies
Customer story pattern: cutting false-positive noise with...
How one team cut AppSec findings 92% and MTTR from 11 days to 36 hours by consolidating scanners — a reduce security tool noise false positives case study.
May 2, 20267 min read
Containers
Writing a Secure Kubernetes Dockerfile: A Practical Hardening Guide
The Dockerfile you write decides most of a pod's attack surface before Kubernetes ever schedules it. Here is how to build images that run non-root, stay small, and survive a security review.
May 2, 20265 min read
Containers
Kubernetes CVE News: How to Track and Respond to Cluster Vulnerabilities
Where Kubernetes CVE news actually breaks, how to read a cluster advisory, and a repeatable process for triaging vulnerabilities before they turn into an incident.
May 2, 20266 min read
Vulnerability Analysis
Regular expression DoS in the ms npm package
A ReDoS flaw in the ubiquitous npm package ms (CVE-2015-8315) still surfaces in dependency scans today. Here's the impact, fix, and remediation steps.
May 2, 20267 min read
Security
Inversion of Control in JavaScript: The Security Angle Nobody Explains
Inversion of control in JavaScript decouples your code from its dependencies, but handing over instantiation also hands over a piece of your attack surface. Here is how to get the design benefit without the security cost.
May 2, 20265 min read
Security
What Is an IAM Permission Boundary and When to Use One
An IAM permission boundary is a ceiling on what a role or user can ever do, no matter how generous their attached policies are. Here is how to wield it without locking yourself out.
May 1, 20265 min read
Containers
Docker Hub Node.js Images: How to Pick and Harden the Right Tag
The official Docker Hub Node.js images come in a dozen variants, and the tag you choose decides your image size, patch cadence, and attack surface. Here is how to read them.
May 1, 20265 min read
AppSec
What Is a DAST Solution? Choosing Dynamic Testing for Web Apps
A DAST solution tests your running application from the outside, the way an attacker would. Here is how dynamic testing works, what it catches, and how to pick one that fits your pipeline.
May 1, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.