DevSecOps
Compromised npm packages in the React and Next.js build p...
A react npm supply chain incident case study: how a phishing attack on a single maintainer compromised chalk, debug, and other build-pipeline dependencies.
Jan 23, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Australia's Critical Infrastructure Security Act and Software Supply Chain Risk
Australia's SOCI Act imposes strict cybersecurity obligations on critical infrastructure. Here's what software suppliers need to understand.
Jan 23, 20266 min read
Dependency Management
Setting Up Continuous Dependency Monitoring From Scratch
Point-in-time dependency scans miss vulnerabilities disclosed between scans. Here is how to set up continuous monitoring that catches new threats as they emerge.
Jan 23, 20267 min read
Industry Analysis
AI Agent Security: 6 Risks Beyond Traditional Controls
Gartner projects a third of enterprise apps will run agentic AI by 2028. Here are six AI agent security risks traditional controls miss.
Jan 23, 20267 min read
Tool Reviews
GitLab Ultimate Security Features: Built-In Security Done Pragmatically
A review of GitLab Ultimate's security scanning features covering SAST, DAST, dependency scanning, container scanning, and how integrated security compares to best-of-breed tools.
Jan 23, 20265 min read
Incident Analysis
Polyfill.io CDN Supply Chain Attack: 100K+ Sites
After a domain handover, polyfill.io began serving malware to more than 100,000 sites. Here is the attack chain and what the incident teaches us.
Jan 23, 20266 min read
Dependency Security
Swift CocoaPods and SPM Security
Securing iOS and macOS dependencies with Swift Package Manager and CocoaPods, including checksum verification and source control.
Jan 22, 20264 min read
DevSecOps
Spinnaker Deployment Security
Securing Spinnaker's multi-cloud deployment pipelines with authentication, authorization, pipeline constraints, and artifact verification.
Jan 22, 20265 min read
Cloud Security
Securing GCP Artifact Registry: A Complete Guide
How to configure GCP Artifact Registry for security-first container and package management, from IAM policies to vulnerability scanning.
Jan 22, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.