Open Source Security
Ruby Gem Reserved Names Policy
How RubyGems.org handles reserved gem names, what protections exist for trademark holders, and where the policy creates friction for legitimate namespace claims.
Feb 18, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedBest Practices
Vault Supply Chain Integration Patterns
HashiCorp Vault is a Swiss Army knife for secrets, but most teams use it as a glorified key-value store. A walkthrough of the integration patterns that make Vault actually useful in a CI/CD supply chain.
Feb 18, 20267 min read
Product
ESSCM: Enterprise SBOM Management at Scale
Managing SBOMs across hundreds of products requires more than file storage. ESSCM brings lifecycle management, versioning, and queryability to your software inventory.
Feb 18, 20267 min read
Open Source
How to Set Up Tailwind CSS with Vue 3 Safely
Getting Tailwind CSS working in a Vue 3 project takes a few minutes. Keeping the toolchain secure and your bundle clean is what separates a throwaway demo from production.
Feb 18, 20265 min read
AppSec
Security Testing for Data Pipelines: A Practical Guide
Data pipelines ingest, transform, and move sensitive information across systems. Here is how to identify and address the security risks that traditional application testing misses.
Feb 18, 20266 min read
Incident Analysis
Two Years of Item 1.05: What the Notable 8-K Filings Tell Us
From UnitedHealth to AT&T to Snowflake's downstream effects, two years of Item 1.05 filings reveal patterns in materiality, vendor incidents, and update cadence.
Feb 18, 20267 min read
AI Security
Multi-Modal AI Supply Chain Considerations
Multi-modal models bring image, audio, and video into the AI supply chain. Each modality introduces provenance and integrity challenges that text-only pipelines never had to face.
Feb 18, 20268 min read
AI Security
MCP Transport Layer Security Options
MCP supports stdio, streamable HTTP, and a handful of experimental transports. Each has distinct security properties, and the choice of transport constrains every other security decision you make about the deployment.
Feb 18, 20266 min read
Open Source Security
Hugging Face's Guardian-Plus-Picklescan Stack: How the Model Hub Scanning Posture Evolved Through 2025-2026
Following NullifAI and the broken-pickle bypass campaigns, Hugging Face layered Protect AI's Guardian on top of Picklescan, ClamAV, and secrets scanning across 1.5 million public models. Here is the defender view of the new pipeline.
Feb 18, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.