AI Security
What is Model Context Protocol (MCP) Security
MCP security explained: how tool poisoning, rug pulls, and 2025's critical CVEs (mcp-remote, MCP Inspector) put AI agents at risk—and how to defend against them.
Mar 3, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainer Security
The Minimal Base Image Myth: What Actually Reduces Attack Surface
Alpine, distroless, and scratch images don't automatically cut risk. The real attack-surface drivers are capabilities, root filesystem, network policies, and seccomp.
Mar 3, 20267 min read
Best Practices
How to Comply With EU CRA: A Practical Checklist
The EU Cyber Resilience Act requires vendors to ship secure-by-default products, provide SBOMs, and report exploited vulnerabilities within 24 hours. Here is a concrete compliance path.
Mar 3, 20267 min read
Best Practices
FastAPI Supply Chain Security: A Working Guide
FastAPI's dependency surface is deceptively large. Here is how to lock it down in practice, covering Starlette, Pydantic, Uvicorn, and the plugins you likely missed.
Mar 3, 20266 min read
Open Source Security
Typosquatting packages
What is typosquatting? A precise breakdown of package typosquatting attacks, real npm and PyPI examples, and how lookalike malicious packages slip into builds.
Mar 3, 20266 min read
Best Practices
Right-to-Repair and Software Supply Chain Security
How the right-to-repair movement is reshaping software supply chain obligations in 2026, from firmware transparency to the security implications of mandated component access.
Mar 3, 20267 min read
Supply Chain Attacks
npm Protestware Patterns From 2020 to 2026
A senior engineer's view of six years of npm protestware, from colors.js to peacenotwar, and the supply chain lessons that still apply to modern JavaScript shops.
Mar 3, 20267 min read
Application Security
GitLab Ultimate Security Buyer Review 2026
GitLab bundles SAST, SCA, container scanning, and DAST into the Ultimate tier. Is the integrated story worth the premium over best-of-breed tools? An honest review.
Mar 3, 20266 min read
Vulnerability Management
bundler-audit Production Setup
A practical guide to running bundler-audit in production CI pipelines, including advisory database updates, exception handling, and integration with remediation workflows.
Mar 3, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.