Incident Analysis
Ledger Connect Kit Attack: What Devs Missed
A phishing-obtained GitHub token published a wallet drainer as @ledgerhq/connect-kit in Dec 2023. What the incident tells us about Web3 supply chain trust.
Feb 1, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Analysis
Zenbleed: AMD CPU Vulnerability Leaks Data Across Processes (CVE-2023-20593)
A speculative execution bug in AMD Zen 2 processors allows attackers to steal sensitive data at 30KB per core per second, affecting cloud environments and shared infrastructure.
Jan 31, 20265 min read
Software Supply Chain Security
Python Wheel Security Verification: What You Are Missing
Python wheels are the standard packaging format, but their security verification story has significant gaps that most developers never consider.
Jan 31, 20265 min read
DevSecOps
Security Challenges in Polyglot Repositories
Repositories containing multiple programming languages multiply the security tooling, configuration, and expertise required. These challenges are manageable with the right approach.
Jan 31, 20266 min read
Dependency Security
Golang Module Security and Verification
Securing your Go module supply chain with checksum databases, GOPROXY, and vendor directories.
Jan 31, 20265 min read
How-To Guide
Automated Security Testing in CI/CD Pipelines
A hands-on guide to embedding SAST, SCA, secret scanning, and container analysis into your CI/CD pipeline without making builds unbearably slow.
Jan 31, 20266 min read
Application Security
IAST Explained: Why Instrumented Security Testing Catches What Others Miss
IAST combines the precision of SAST with the realism of DAST. Here is how it works, where it fits, and what it actually costs to deploy.
Jan 31, 20267 min read
Best Practices
Reproducible Builds in the Go Ecosystem
Go's toolchain makes reproducible builds unusually tractable. Here is how to reach bit-for-bit builds across machines in 2023, and where the rough edges remain.
Jan 31, 20265 min read
DevSecOps
CI/CD Secret Sprawl: How Pipeline Credentials Become Your Biggest Risk
Your CI/CD pipeline has more credentials than your production environment. Secret sprawl across pipelines creates a massive attack surface that most teams cannot even inventory.
Jan 31, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.