Cloud Security
Dependency Confusion Attack
How dependency confusion attacks exploit registry name collisions to run attacker code inside corporate networks, from Alex Birsan's 2021 research to the 2022 PyTorch breach.
Apr 13, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
webpack-bundle-analyzer: Find Bloat and Risky Dependencies in Your Bundle
webpack bundle analyzer turns your build output into a zoomable treemap. Used well, it finds not just bloat but duplicated packages, surprise transitive dependencies, and code you never meant to ship.
Apr 13, 20267 min read
Application Security
What is Vulnerability Scanning
Vulnerability scanning automatically checks code, dependencies, and infra against known-flaw databases like the NVD. Here's how it works and why reachability matters.
Apr 13, 20267 min read
Open Source
broadcast-channel npm Package: Health, Security, and Alternatives
A practitioner review of the broadcast-channel npm package: maintenance health, how its storage fallbacks work, the security boundaries of cross-tab messaging, and when the native API is enough.
Apr 13, 20267 min read
Cloud Security
Repojacking
Aqua Security found nearly 37,000 GitHub repos vulnerable to repojacking, including Google and Lyft. Here's how the attack works and how Safeguard catches it.
Apr 13, 20267 min read
AppSec
Mobile Security Testing for iOS and Android Apps
Mobile apps fail in ways web apps don't — insecure local storage, weak certificate pinning, reverse-engineerable binaries — and testing them requires methods most web-focused AppSec programs never built.
Apr 13, 20266 min read
Containers
Docker LABEL: A Security and Metadata Guide
How the Docker LABEL instruction works, the OCI annotation conventions worth adopting, and how good labels make image supply chains auditable.
Apr 13, 20265 min read
Application Security
What is Vulnerability Management
Vulnerability management turns thousands of CVEs into a ranked, fixable backlog. Here's how the lifecycle, prioritization, and standards actually work.
Apr 13, 20266 min read
Cloud Security
Container Image Signing
Signing tells you where a container image came from; scanning only tells you what's inside it. Here's how image signing works, how Aqua handles it, and what a complete solution needs.
Apr 13, 20268 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.