Software Supply Chain Security
pip Install Hooks Security: The Python Packaging Backdoor
Python's setup.py runs arbitrary code during package installation. Despite efforts to move to declarative metadata, the risk persists.
Feb 2, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedOpen Source Security
Bundler dependency pinning and Gemfile.lock as a supply c...
A step-by-step guide to Gemfile.lock security: pin gems deliberately, enforce ruby lockfile integrity with checksums, and lock down bundle install in CI/CD.
Feb 2, 20268 min read
DevSecOps
Dev Container Security Posture (incl. Dotfiles)
Dev containers promise reproducibility and isolation. They also pull in a long tail of scripts, dotfiles, and feature repos that most teams never audit. Here is how to fix that.
Feb 2, 20267 min read
Best Practices
Measuring AppSec Program Effectiveness in 2026
The metrics that actually distinguish high-functioning application security programs from theater, with concrete formulas and reporting cadences for 2026.
Feb 2, 20266 min read
Threat Intelligence
RansomHub Ransomware and EDR Bypass (2024)
RansomHub absorbed affiliates displaced by BlackCat and ran one of the most prolific extortion operations of 2024. Here is what made its tradecraft effective and how to counter it.
Feb 2, 20267 min read
Open Source Security
Rust crates.io Supply Chain Controls in 2026
crates.io has gained real supply chain features over the past two years. Here is an honest read on what works, what is still immature, and where to invest.
Feb 2, 20266 min read
Company
Safeguard Explores Partnership With Sify Technology (USA)
Safeguard is in early discussions with Sify Technology (USA) to evaluate a joint motion across network services, managed security, and enterprise reach.
Feb 2, 20268 min read
Architecture
Griffin Agent Loop: Design Decisions
The design rationale behind Griffin, Safeguard's triage agent — how the loop is structured, why we bounded reasoning depth, and how tool calls stay auditable.
Feb 2, 20268 min read
Threat Intelligence
Salt Typhoon Telecom Supply Chain Campaign 2024
Salt Typhoon's 2024 intrusions into U.S. telecoms reframed supply chain risk as a routing and lawful-intercept problem. Here is what the campaign looked like from a defender's seat.
Feb 2, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.