DevSecOps
3CX Attack Lessons: What Every Software Vendor Must Do Differently
The 3CX supply chain attack exposed critical gaps in how software vendors protect their build pipelines. Here are the concrete lessons.
Jan 24, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain Attacks
3CX Supply Chain Attack: A Deep Dive into the North Korean Compromise
The 3CX supply chain attack was a multi-stage operation linked to North Korea's Lazarus Group. Here's the full technical breakdown.
Jan 24, 20266 min read
Open Source Security
The March 2023 PyPI Malware Wave
PyPI paused new user registration for most of May 20-23 after a March wave of typosquats and info-stealers flooded the index. Here is what happened and why.
Jan 24, 20265 min read
Compliance
FISMA and Federal Software Security: Supply Chain Requirements Explained
FISMA's authorization framework creates strict requirements for software in federal systems. Here's how supply chain security fits into the ATO process.
Jan 24, 20266 min read
Cloud Security
Azure Container Registry Security: Locking Down Your Image Pipeline
How to secure Azure Container Registry with network isolation, content trust, and Microsoft Defender for Containers integration.
Jan 24, 20267 min read
Incident Response
OpenAI ChatGPT Data Breach March 2023: What Was Exposed
A bug in ChatGPT exposed user chat histories and payment information. Here's what happened and what it means for AI service security.
Jan 24, 20266 min read
Threat Modeling
Threat Modeling the Software Supply Chain
Traditional threat modeling focuses on your code. Supply chain threat modeling extends to every tool, dependency, and process that touches your software. Here is how to do it systematically.
Jan 24, 20268 min read
Security Management
Quantifying Security Debt: Methods That Actually Work
Everyone talks about security debt. Almost nobody measures it. Here are practical methods for putting numbers on the security shortcuts your organization has accumulated.
Jan 24, 20266 min read
DevSecOps
GitLab CI Security Scanning Setup
Step-by-step guide to enabling SAST, DAST, dependency scanning, and container scanning in GitLab CI pipelines.
Jan 24, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.