Vulnerability Analysis
Log4Shell RCE in Apache Log4j (CVE-2021-44228)
A deep dive into CVE-2021-44228 (Log4Shell): the critical Log4j RCE vulnerability, its timeline, affected versions, and concrete remediation steps.
Jan 19, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
LDAP Injection Prevention Guide
LDAP injection attacks manipulate directory service queries to bypass authentication, extract sensitive data, and enumerate user accounts. This guide covers attack techniques and practical defenses for applications using LDAP.
Jan 19, 20266 min read
Cloud Security
Using AWS IAM Access Analyzer to find unused and external...
How AWS IAM Access Analyzer surfaces unused permissions and external access risk across your AWS accounts, and where native findings need extra context to prioritize.
Jan 19, 20266 min read
Software Supply Chain
Dependency Graph Analysis: Finding Hidden Transitive Risks
Your project has 50 direct dependencies. It actually depends on 1,200 packages. Transitive dependency analysis is how you find the risks hiding three layers deep.
Jan 19, 20268 min read
Vulnerability Analysis
Apache Struts2 RCE behind the Equifax breach (CVE-2017-5638)
CVE-2017-5638, the Apache Struts2 RCE behind the Equifax breach, exposed 147.9M records. Here's the flaw, timeline, and how to remediate it.
Jan 19, 20267 min read
Incident Response
Incident Response Playbook for Supply Chain Attacks
Supply chain attacks break your standard IR playbook. The compromise originates outside your perimeter, affects trusted software, and the blast radius is unknown. Here's how to adapt.
Jan 19, 20269 min read
Cloud Security
How AWS STS temporary credentials reduce long-lived key risk
Long-lived AWS keys sit in code and CI logs for years. AWS STS temporary credentials expire automatically, shrinking the window attackers have to exploit a leak.
Jan 19, 20268 min read
Emerging Technology
5G Networks and the Software Supply Chain Risks Nobody Talks About
5G networks are software-defined infrastructure built on open-source components. The supply chain implications are enormous and under-discussed.
Jan 19, 20266 min read
Offensive Security
Penetration Testing the Software Supply Chain
Traditional pentests focus on the application. Supply chain pentesting targets the build pipeline, dependency resolution, and distribution mechanisms. Here is how to approach it.
Jan 19, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.