Open Source Security
npm Lockfile v3 Security Improvements
Lockfile v3 is more than a format bump. It quietly fixed a class of integrity bugs that plagued v1 and v2, and the difference matters more than most teams realize.
Feb 1, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
LLM Prompt Injection: The New Supply Chain Attack Vector
Prompt injection attacks against large language models represent a dangerous new frontier in software supply chain security. Here's what defenders need to know.
Feb 1, 20266 min read
Vulnerability Analysis
Ivanti EPMM Zero-Day CVE-2023-35078: Norwegian Government Breach
A critical authentication bypass in Ivanti's Endpoint Manager Mobile was exploited to breach Norwegian government agencies, earning a perfect CVSS 10.0 score.
Feb 1, 20264 min read
Software Supply Chain Security
Internal Package Naming Best Practices to Prevent Dependency Confusion
The wrong naming convention for internal packages makes dependency confusion attacks trivial. Here is how to name packages so attackers cannot substitute them.
Feb 1, 20264 min read
Open Source Security
The Hidden Risk of Abandoned Open Source Projects
Abandoned open source projects do not disappear. They continue to be installed, depended upon, and deployed in production. They just stop getting security patches.
Feb 1, 20266 min read
AI Security
Audit Log Completeness: Griffin AI vs Mythos
Audit logs are where enterprise AI either proves its seriousness or exposes its improvisation. The gap between Griffin AI and Mythos-class products is visible in the first day of a real audit.
Feb 1, 20267 min read
AI Security
Griffin AI vs OpenAI o1 for Security Reasoning
Deep reasoning models are transformative for hard logical problems. Security reasoning is only partially a logic problem—the rest is grounding, policy, and workflow.
Feb 1, 20267 min read
AI Security
Small-Model Distillation For Security Workflows
Distillation compresses the capability of a large model into a small one for a narrow task. For high-volume security workflows, it is often the difference between a working pipeline and an unaffordable one.
Feb 1, 20266 min read
SBOM & Compliance
How to Generate SBOMs From Maven Projects
Produce accurate CycloneDX SBOMs from Maven builds using the official plugin, handle multi-module reactors, and ship attested SBOMs alongside your JARs.
Feb 1, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.