DevSecOps
org.json Maven: A Security Guide
The org.json Maven dependency ships a small JSON parser with a history of denial-of-service bugs. Here is how to pin a safe version and catch it transitively.
Apr 3, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainers
Node.js in Docker: Choosing and Securing Your Base Image
The Docker Node base image you pick decides your CVE count before you write a line of code. Here is how to choose between Debian, slim, and Alpine — and harden whichever you pick.
Apr 3, 20267 min read
Open Source Security
Open Source License Compliance
Redis, Elasticsearch, and Terraform all changed licenses in the last three years. Here's how license compliance actually breaks, and how to catch it before you ship.
Apr 3, 20267 min read
Open Source
React File Viewer: Is It Safe, and What Are the Alternatives?
react-file-viewer still gets thousands of weekly downloads despite going years without an update. Here is what the package does, the risks of a dormant dependency, and how to view files more safely.
Apr 3, 20266 min read
Vulnerability Management
A guide to modern vulnerability scanning
Scanners disagree, CVE volume is exploding, and hardened base images solve only one layer. Here's how modern vulnerability scanning actually works — and where prioritization beats raw CVE counts.
Apr 3, 20268 min read
Containers
Node.js Docker Containers: Build Small, Run Safe
A Node.js Docker container that is both small and secure: multi-stage builds, npm ci with a lockfile, non-root users, and why you should not run as PID 1.
Apr 2, 20265 min read
Security
What Is a Security Development Model and How Do You Run One?
A security development model bakes threat modeling, code review, and testing into every stage of the SDLC instead of bolting security on at the end. Here is how the model works in practice.
Apr 2, 20266 min read
Security
Cloud Security Intelligence: How to Turn Signals Into Action
Cloud security intelligence is the practice of correlating raw telemetry from your cloud accounts into prioritized, actionable risk. Here is how to build it without drowning in alerts.
Apr 2, 20267 min read
Security
A Practical Race Condition Example (and How to Fix It)
A race condition example is easiest to understand through a bank-balance check-then-act bug. Here is the anatomy, the exploit, and three ways to close it.
Apr 2, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.