Cloud Security
In-depth guides and analysis on cloud security from the Safeguard engineering team.
100 articles
Find Entra User Accounts Used as Service Accounts Before MFA Breaks Them
Azure's mandatory MFA does not apply to managed identities or service principals, but it does apply to a user account running a script. A short audit to find and migrate them.
.env Files in Docker Images: What Flare Found and How to Stop It
Flare found 10,456 Docker Hub images with exposed keys in November 2025, and .env files were a common cause. Check your images, fix the build, and rotate what leaked.
Pod user namespaces are stable: set hostUsers to false and verify
Kubernetes calls pod user namespaces stable since v1.36. Here is what your nodes need, the one field that turns it on, and how to prove the mapping works.
Kubernetes 1.37 lets you mount volumes noexec: what to test now
Kubernetes v1.37 adds alpha bind mount options and an emptyDir mode field. Here is how to try noexec, nosuid and a sticky bit on a test cluster.
Audit who can write StatefulSets and ControllerRevisions in Kubernetes
CVE-2026-2270 turns namespace-scoped write access into a pod in another namespace. Use it as the reason to run a real RBAC audit with kubectl and jq.
Block risky Ingress annotations with a ValidatingAdmissionPolicy
Two 2026 ingress-nginx advisories turn Ingress annotations into code execution. A built-in CEL policy can block them in minutes, with no webhook to run.
Default-deny egress for ingress controllers: a NetworkPolicy starter
When ingress-nginx code execution is the risk, outbound limits decide what an attacker can steal. A short NetworkPolicy starter with the DNS gotcha.
Base image rebuild cadence after Debian 13.7: a schedule you can run
Debian 13.7 rebuilt many packages against a patched glibc. Use the release and Docker Hub tag dates to set a rebuild cadence for your own images.
Scan Terraform plans in pull requests with Trivy: a working gate
Terraform 1.16.6 and Trivy 0.76.0 both shipped on 14 October 2026. Here is a pull request gate that scans HCL and the plan, with exceptions that expire.
S3 public exposure checks: Block Public Access, Config, CLI loop
AWS Config added 77 resource types on 7 October 2026. Use that moment to check storage exposure at four levels with the AWS CLI and managed Config rules.
CloudTrail must-haves: an organization trail and an SCP to protect it
AWS closed CloudTrail Lake to new customers and added identity filters for network events in 2026. Here is the trail setup every multi-account estate should have.
Safeguard IaC: scanning Terraform and Kubernetes before merge
What the IaC page says about formats, plan time gating, drift detection and policies, and which claims to test on your own repository.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.