Case Studies
Netflix's Open-Source Security Approach
How Netflix manages security across hundreds of open-source projects and thousands of internal dependencies while maintaining the velocity that streaming demands.
Feb 11, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source Security
npm audit vs pnpm audit vs yarn audit
Three audit tools, three philosophies, three blind spots. A ground-level comparison of how npm, pnpm, and yarn surface vulnerabilities, and where each one leaves you exposed.
Feb 11, 20267 min read
Application Security
React Application Security Guide
Securing React applications from XSS, dependency vulnerabilities, and common frontend attack patterns.
Feb 11, 20265 min read
Industry Guides
Manufacturing OT Software Supply Chain: Securing the Factory Floor
Manufacturing OT systems depend on software supply chains that most security teams don't monitor. Here's how to extend supply chain security to the factory floor.
Feb 11, 20267 min read
Incident Analysis
Microsoft Breached by Midnight Blizzard: Russian Hackers Read Executive Emails
In January 2024, Microsoft disclosed that the Russian state-sponsored group Midnight Blizzard had been reading emails of senior executives and security team members since November 2023, using a password spray attack against a legacy test account.
Feb 11, 20267 min read
Threat Intelligence
Midnight Blizzard Breaches Microsoft: What the Exchange Online Attack Means for Everyone
Russian state actors compromised Microsoft executive email accounts through a password spray attack on a legacy test tenant. The breach exposed how identity misconfigurations cascade.
Feb 11, 20266 min read
Tool Reviews
Veracode SCA: Mature Application Security Meets Dependency Scanning
An overview of Veracode's SCA capabilities within their broader application security platform, covering vulnerability prioritization, agent-based scanning, and enterprise features.
Feb 11, 20265 min read
AI Security
Container-Specific Vulnerability Management Tools, Compared
A field guide to container-specific vulnerability management tools: what Trivy, Grype, Clair, Docker Scout, and Anchore actually catch, and where each falls short.
Feb 11, 20267 min read
Open Source
npm chai: A Security Review and Safe Usage Guide
Chai is a staple assertion library for JavaScript testing. Here is an honest look at the security profile of the npm chai package and how to keep it out of your production bundle.
Feb 11, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.