Cloud Security
In-depth guides and analysis on cloud security from the Safeguard engineering team.
100 articles
Safeguard Secure Containers: pin, sign and verify base images
Hardened base images, an immutable digest, a signature and an SBOM on every tag. What the page lists and how to check it yourself with cosign.
ISTIO-SECURITY-2026-007: Lowercase HTTP/2 Methods Skip DENY Rules
Istio's 15 October bulletin fixes an AuthorizationPolicy bypass over HTTP/2, an ambient istiod crash and two Envoy filter crashes. Versions, checks and fixes.
External Secrets CVE-2026-26287: Webhook Generator Skips Its Label Check
An init-order bug let External Secrets Operator's webhook generator read Secrets not labeled for it and send them to any URL. Fixed in 1.3.2, disclosed 6 October.
Argo Workflows 4.1.4: Artifact Path Traversal and an Archive Tenant Leak
Two Argo Workflows advisories from 18 September: bucket object keys that write outside the workspace, and a field selector that leaks other tenants' archived workflows.
Kyverno 1.19.1: Namespaced Policies That Escalate to Cluster Admin
Kyverno's 10 September advisories: a tenant's namespaced Policy could make Kyverno create cluster objects, and image verification exceptions exempted every image.
Traefik 3.7.13 and 2.11.57: HTTP/3 Identity Reuse and Routing Bypasses
Traefik's September advisories cover a critical HTTP/3 NTLM connection reuse bug and requests that slip past routers and middleware. Versions, checks and fixes.
One Shared Deploy Credential Is Forty Pipelines' Worth of Blast Radius
Set up once, when there was one service. Forty pipelines later, every one of them still uses it, and it can deploy to production, which means it can read the secrets and infrastructure of everything it touches.
Your Terraform State Is a Secrets Store With a Build Artefact's Access Control
The database password, the generated private key, the API token an output exposed. You did not put them there directly. Terraform did, because it needs the full attributes of everything it manages to plan the next change.
The Kubernetes Token Nobody Asked For
Every pod gets a token that authenticates to the API server, whether the application inside it ever calls the API or not. It sits there anyway, readable by anything that can read a file in the container, because the default is on.
Your Free Tier Is Compute You Hand to Strangers
That is the point of it, and it is also a standing offer to everyone who wants compute, a clean network position or storage for a purpose you did not intend. The abuse is rarely sophisticated.
Encryption at Rest Protects Against Roughly One Thing
It is on every security page, it is true, and it covers someone taking the physical disk. Every other way your data gets read happens through a path where it is already decrypted, because the encryption is transparent by design.
Autoscaling Turned the Attack Into an Invoice
Every request was served, no alerts fired, the dashboards stayed green. The properties that made your infrastructure resilient are what made the attack work, and the only symptom arrives weeks later on a bill.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.