Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
The react-phone-input-2 npm package has half a million weekly downloads and no releases since 2021. A practical review of three form-layer dependencies and what each one really costs.
MCP is standardizing how AI agents call tools, and attackers are already exploiting tool poisoning, rug pulls, and shadowing. Here's what MCP security actually requires.
SAST scans read your source code without running it, tracing untrusted data from input to sink to catch injection and other flaws before they ship.
Node's vm module and vm2 were never a security boundary. Four critical CVEs and a 2023 deprecation prove why untrusted-code sandboxes need real isolation.
A maximum-severity vulnerability in Erlang/OTP's SSH server allowed unauthenticated remote code execution. Any system running Erlang's built-in SSH daemon was at risk, including telecom infrastructure.
OWASP's Top 10 for LLM Applications reframes AI risk around prompt injection, data poisoning, and supply chain gaps that container-only tools like Aqua can't reach.
A practical guide to how to run JavaScript code in the browser, with Node.js, and from the command line, plus the security traps that turn a convenient runner into a liability.
SAST and DAST test different layers of an application at different stages of the pipeline — the real question isn't which to pick, it's how to run both without duplicating effort.
Five layers cover most of the risk in cloud apps: identity, secrets, artifact scanning, pipeline gates, and runtime guardrails. Here is how to build each one without slowing delivery.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
