Best Practices
In-depth guides and analysis on best practices from the Safeguard engineering team.
252 articles
React Native Supply Chain Risks in 2024
React Native bundles native modules, JavaScript dependencies, and CodePush-style OTA updates into one app. The supply chain is vast and the remediation path is slower than web apps. Here is where it actually goes wrong.
On-Prem to Cloud Supply Chain Continuity
A year inside a financial services cloud migration, and how to keep your software supply chain intact when everything else about the environment changes.
How to Prevent Dependency Confusion in npm (2026)
Dependency confusion attacks are still landing in 2026 because scoped packages, registry config, and provenance checks are misconfigured by default. Here is the fix.
Package Registry Forensic Log Analysis
Extracting investigative signal from package registry logs — publish events, download patterns, and account activity — during a supply chain incident.
AWS SSM Parameter Store Security
Parameter Store is everywhere in AWS workloads, which means it accumulates secrets, configuration, and bad IAM over time. Here is the security review I run on every Parameter Store deployment.
Best SCA Tools for Enterprise: 2026 Comparison
A fact-based 2026 review of the best Software Composition Analysis tools for enterprise teams, covering depth, reachability, remediation, and compliance.
Azure App Service Deployment Security
App Service deployments are easy, which is the problem. A look at the deployment paths, credential surfaces, and hardening steps that matter for production workloads.
Automating Third-Party Risk Assessment: Moving Beyond Spreadsheets and Questionnaires
Why manual vendor risk assessments are failing, and how automation is reshaping third-party risk management for software supply chains.
GCP Pub/Sub Security Configuration
A working security configuration for GCP Pub/Sub: topic and subscription IAM, message encryption, VPC Service Controls, dead-letter handling, and the failure modes that turn a messaging layer into an attack surface.
Signed Artifact Policy Enforcement In 2026
Signing artifacts is necessary but not sufficient. The policy that verifies signatures, attestations, and trust roots is what turns signing into a security control.
Doppler Enterprise Secrets Platform Reviewed
Doppler pitches itself as the secrets platform that gets out of developers' way. A detailed look at what works, what does not, and the trade-offs against Vault, Infisical, and the cloud-native options.
Fastify Security Posture in 2024
Fastify hit version 5.0 in September 2024 with a slimmer core, a plugin model that encourages correctness, and a security track record that genuinely distinguishes it from the Express crowd. Here is what I have learned auditing Fastify apps this year.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.