DevSecOps
In-depth guides and analysis on devsecops from the Safeguard engineering team.
497 articles
Is Node.js Safe? A Security Guide for Production Apps
Is Node.js safe to run in production? The runtime itself is well maintained and secure by modern standards. The real risk lives in the dependency tree and how you configure the app around it.
Why Automated Package Publishing Pipelines Are a Growing ...
From tj-actions to xz utils, attackers are hijacking CI/CD pipelines to poison packages at the source. Here's why publishing pipelines are the new frontline.
Policy-as-code for CI/CD: enforcing security gates withou...
How policy-as-code turns security gates from build-breaking friction into fast, git-versioned CI/CD checks — and where Safeguard's approach differs from JFrog's Xray and Curation model.
Continuous Integration Security: A Checklist
Continuous integration security means treating your CI pipeline as a production system, because an attacker who compromises your CI runner can ship malicious code as easily as your own engineers.
Best DevSecOps tools to secure the SDLC
Comparing the best DevSecOps tools to secure the SDLC: Mend.io's SCA-first platform vs Safeguard's reachability-driven, supply-chain-wide approach.
Node.js vm Module Security: Why It Is Not a Sandbox
The Node.js vm module runs code in a separate V8 context, but it is not a security sandbox. Here is why untrusted code can escape it and what to use instead.
How to Choose a Python Code Checker for Secure Code
A Python code checker is more than a linter. Here is how the layers fit together, which open-source tools do what, and where online checkers help and hurt.
@types/node Explained: What the Package Does and Why It Matters for Security
@types/node is the TypeScript definitions for Node.js, pulled from DefinitelyTyped. Here is how it works, why version drift causes headaches, and its real supply-chain footprint.
How to Uninstall Java Safely on Windows, macOS, and Linux
To uninstall Java cleanly you need to remove the runtime, clear leftover paths and environment variables, and confirm nothing critical still depends on it.
Shift Left Fatigue: Why Developers Are Pushing Back on Se...
Shift-left security handed developers new duties without removing old ones. Here's why teams are pushing back — and how better tooling fixes the real problem: noise, not ownership.
Why Security Training Completion Rates Don't Predict Secu...
Completion rates measure attendance, not behavior. Here's why training checkboxes don't predict secure coding outcomes, and what to measure instead.
Friction as a Security Metric: Measuring Tool Adoption Fa...
Security tools fail quietly when developers route around them. Here's how to measure friction as a leading indicator of adoption failure before it causes a breach.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.