Safeguard on social

Your agent is about to get a new tool. Who wrote it, and what can it touch? Look the MCP server up on Gold Open Source first. Free, no login. You see the publisher namespace, the version, hosted endpoint or installable package, and the source repo. A package means their code runs on your machine, so check what it depends on. Gold does not list tools or scopes, so read those in a test client. Full routine: link in bio, http://safeguard.sh/resources/blog #MCP #AIsecurity #AppSec #DevSecOps

Your agent is about to get a new tool. Who wrote it, and what can it touch? Look the MCP server up on Gold Open Source (https://na2.hubs.ly/H08LgDx0) first. It is free and needs no login. The page shows the publisher namespace, the version, hosted endpoint or installable package, the transport, the source repository and a license note. A package means their code runs on your machine, so check what it depends on. Gold does not list tools or scopes, so read those yourself in a test client. Full routine: https://na2.hubs.ly/H08LgF30 Stock footage: Mixkit (Mixkit Stock Video Free License). Page recordings: https://na2.hubs.ly/H08LgF40, public pages. #MCP #AIsecurity #Shorts

Your agent is about to get a new tool. Who wrote it, and what can it touch? Look the MCP server up first on Gold Open Source (https://na2.hubs.ly/H08LgD30), free with no login. You see the publisher namespace, the version, hosted endpoint or installable package, and the source repository. A package means their code runs on your machine, so check what it depends on. Gold does not list tools or scopes, so read those yourself in a test client. https://na2.hubs.ly/H08Lgz30

Your agent is about to get a new tool. Who wrote it, and what can it touch? Gold Open Source shows the publisher namespace, version, hosted or installable, and the source repo. Free, no login. Tools and scopes you read yourself in a test client. https://t.co/UP4iT3qXkT https://t.co/QCaZIO32Uk

Day one on a new team. Sam installs one extension, signs in, and a warning shows up on a package she didn't choose. Mira and Cal walk through her first ten minutes with Safeguard in the editor and in the chat window: install the VS Code or JetBrains extension, sign in with the device flow, pick a remediation strategy, apply one fix, read the diff, and hand the pull request to a teammate. Then they connect Claude or ChatGPT to Safeguard's hosted MCP server and see what a fresh workspace can and cannot do. In the news, three October stories about things that ran before a person looked: a malicious LiteLLM release on PyPI (JFrog, 21 Oct; LiteLLM's own account, 23 Oct), a planted AGENTS.md that led Codex to try installing a malicious package (Forever Security, 25 Oct), and an npm worm that armed GitHub repositories with startup hooks for Claude, Cursor and VS Code (JFrog, 26 Oct). Under the hood, the inline Package Firewall check for typosquatting, dependency confusion and malicious package names, why a hosted MCP server means there is no package to install, and what to ask about any AI coding agent. Theo brings one setting, and the episode ends with a try-this-today checklist for secure coding with AI. Topics: AI coding agents, secure coding with AI, VS Code extension, JetBrains plugin, MCP server, MCP security, Claude connector, ChatGPT, Cursor, Claude Code, OpenAI Codex, LiteLLM, JFrog, Forever Security, AGENTS.md, npm worm, malicious packages, typosquatting, dependency confusion, supply chain security, code review of AI generated code. Chapters: 00:00 Cold open 00:28 Intro 00:51 News: LiteLLM 1.107.0, a planted AGENTS.md, and the npm worm hooks 04:05 Sam's first ten minutes: editor and chat 08:07 Under the hood 10:02 Theo's one setting 10:52 Try this today 11:58 Outro Links: Safeguard: https://safeguard.sh/?utm_source=podcast&utm_medium=video&utm_campaign=permission-prompt&utm_content=ep02 Downloads (editor extensions): https://safeguard.sh/download?utm_source=podcast&utm_medium=video&utm_campaign=permission-prompt&utm_content=ep02 IDE Support documentation: https://docs.safeguard.sh/docs/ide-support?utm_source=podcast&utm_medium=video&utm_campaign=permission-prompt&utm_content=ep02 Connect Claude to Safeguard: https://docs.safeguard.sh/docs/mcp/claude?utm_source=podcast&utm_medium=video&utm_campaign=permission-prompt&utm_content=ep02 Connect ChatGPT to Safeguard: https://docs.safeguard.sh/docs/mcp/openai?utm_source=podcast&utm_medium=video&utm_campaign=permission-prompt&utm_content=ep02 Safeguard blog: https://safeguard.sh/blog?utm_source=podcast&utm_medium=video&utm_campaign=permission-prompt&utm_content=ep02 More episodes: https://safeguard.sh/podcast?utm_source=podcast&utm_medium=video&utm_campaign=permission-prompt&utm_content=ep02 Listen on Spotify: https://open.spotify.com/show/4BN9zeR2XXtDGANjpIMVEx?utm_source=podcast&utm_medium=video&utm_campaign=permission-prompt&utm_content=ep02

Safeguard is now listed among SCA tools on OWASP's Component Analysis page. It is a line in a table, not an endorsement. OWASP says it does not endorse commercial products. The page is still a useful checklist. Our post turns it into a test plan for any SCA tool: inventory, transitive paths, SBOM, VEX and time to a merged fix. Link in bio: safeguard.sh/resources/blog/safeguard-listed-in-owasp-component-analysis-what-sca-tools-do-and-how-to-evaluate-them

Safeguard is now listed among software composition analysis tools on OWASP's Component Analysis page. To be plain about it: the listing is a line in a table. The same page says OWASP does not endorse or recommend commercial products or services. The more useful part is the text above the table. It describes what component analysis covers and which risk factors matter, such as inventory, known vulnerabilities, provenance and license. Our post turns that into a test plan you can run against any SCA tool: check inventory against ground truth, trace transitive paths, export and import SBOMs, see whether VEX changes findings, and time a finding to a merged fix. The post also maps each OWASP risk factor to what Safeguard does, with links to https://lnkd.in/g8yeyeSu. https://lnkd.in/gdhHUY54

Safeguard is now listed among SCA tools on OWASP's Component Analysis page. It is a line in a table, not an endorsement: OWASP says it does not endorse commercial products. The page itself is a good checklist for evaluating any SCA tool. Our post turns it into a test plan: https://na2.hubs.ly/H08J5gS0

Five scanners, five inboxes, one vulnerable library reported three times. Safeguard puts SCA, SAST, DAST, container and IaC findings in one queue, merges duplicates, ranks them with KEV, EPSS and static reachability, and routes each to an owner. Findings it cannot decide on are never suppressed. Link in bio: http://safeguard.sh/resources/blog/one-findings-queue-in-safeguard-unified-findings-autotriage-reachability-and-ownership #AppSec #VulnerabilityManagement #SupplyChainSecurity

The image you are about to push. Has anything checked it yet? If your container scan runs in its own job, it probably pulls the image from a registry. That means the image was already pushed. Scan in the build job instead, right after docker build. The Safeguard CLI reads the local image on the runner and checks the OS packages, the base image and the app dependencies. Only results leave the runner. - Gate the step with a Safeguard policy gate, so a build that breaks your policy stops before your push step runs. - Push only what passed. - Scan again in the deploy job. New CVEs land after the build. Guide with copy-ready steps for five CI systems: https://lnkd.in/g_NKqNAW People footage: Mixkit stock (Mixkit Stock Video Free License). #DevSecOps #ContainerSecurity #AppSec

The image you are about to push. Has anything checked it yet? A scan in a separate job pulls from a registry, so the image is already pushed. Scan in the build job instead: the Safeguard CLI reads the local image and checks OS packages, the base image and app dependencies. Only results leave the runner. Fail the step on a severity, push only what passed, scan again at deploy. Guide: link in bio (http://safeguard.sh/resources/blog) People footage: Mixkit stock. #DevSecOps #ContainerSecurity #AppSec #Docker

A scan in a separate job pulls from a registry, so the image is already pushed. Scan in the build job instead: the Safeguard CLI reads the local image, checks OS packages, the base image and app dependencies, and only results leave the runner. Fail the step on a severity, push only what passed, and scan again at deploy. Full guide: https://na2.hubs.ly/H08LgzL0 People footage: Mixkit stock (Mixkit Stock Video Free License). #DevSecOps #ContainerSecurity #Shorts

The image you are about to push. Has anything checked it yet? A scan in a separate job pulls from a registry, so the image is already pushed. Scan in the build job instead: the Safeguard CLI reads the local image, checks OS packages, the base image and app dependencies, and only results leave the runner. Fail the step on a severity, push only what passed, and scan again at deploy. Full guide: https://na2.hubs.ly/H08LgsC0 People footage: Mixkit stock (Mixkit Stock Video Free License).

Five scanners usually means five inboxes. The same vulnerable library shows up in the dependency scan, again in the container scan, and a third time when static analysis flags the code that calls it. Each copy has its own ID and its own severity. Safeguard writes every engine into one findings model. AutoTriage merges duplicates from different engines into one record, and ranks what is left using CISA KEV, EPSS, static reachability and your own context. Findings it cannot decide on are treated as potentially reachable, never suppressed. Unreachable CVE findings drop to the backlog instead of disappearing. The question to ask any tool that reduces noise: what is it allowed to hide, and how can you check? The post covers ranking, ownership routing and a staged pilot. https://lnkd.in/gqZBcbn2 #AppSec #VulnerabilityManagement #SupplyChainSecurity

Five scanners, five inboxes, one vulnerable library reported three times. Safeguard puts SCA, SAST, DAST, container and IaC findings in one queue, merges duplicates, ranks by risk and routes each to an owner. Anything it cannot decide on is treated as potentially reachable, never suppressed. https://na2.hubs.ly/H08J3Mm0

A yearly questionnaire is a snapshot. Tier your vendors by criticality, ask for SBOMs on a cadence per tier, read a 0 to 100 risk score and get alerts when something changes. Safeguard's Third Party Risk Manager walks the whole loop, from vendor register to renewal decision. Link in bio: http://safeguard.sh/resources/blog/tier-your-software-vendors-in-safeguard-tprm-risk-score-sbom-requests-and-continuous-monitoring #ThirdPartyRisk #TPRM #SBOM #SupplyChainSecurity

A vendor questionnaire tells you what a supplier said on one day. It cannot tell you that a component in their software picked up a known exploited vulnerability in June. The pattern that holds up: put every vendor in one register, tier each by how critical it is to you (Critical, High, Medium, Low), ask for SBOMs on a cadence that matches the tier, and let monitoring re-check them against new vulnerability data. Safeguard's Third Party Risk Manager scores each vendor from 0 to 100, where higher is better, and alerts on change instead of waiting for renewal season. The post walks through tiering, the SBOM request statuses and reminders, how to read the score, and how to turn renewal into a decision. It also says plainly what an SBOM does not cover. https://lnkd.in/gTdUPKuR #ThirdPartyRisk #TPRM #SBOM #SupplyChainSecurity

A yearly vendor questionnaire is a snapshot. Software changes every release. Tier your vendors by criticality, request SBOMs on a cadence per tier, read a 0 to 100 risk score and get alerts when something changes. Here is how Safeguard's Third Party Risk Manager does it. https://na2.hubs.ly/H08LgbJ0