DevSecOps
In-depth guides and analysis on devsecops from the Safeguard engineering team.
497 articles
Building a secure CI/CD pipeline with GitHub Actions
The tj-actions breach exposed secrets in 23,000 repos. Here's how pwn requests, unpinned tags, and self-hosted runners put your CI/CD at risk.
Node Media Server Security: Hardening Your Streaming Stack
Node Media Server turns a Node.js process into an RTMP and HTTP-FLV streaming server. Exposed carelessly, it becomes an open door. Here is how to run it safely.
Boto3 Security: Using the AWS SDK for Python Safely
Boto3 is the AWS SDK for Python, and how you configure its credentials, sessions, and version pinning decides how much of your AWS account you are putting at risk.
Securing self-hosted GitHub Actions runners
Self-hosted GitHub Actions runners trade GitHub's ephemeral isolation for persistent infrastructure access — here's how real incidents like CVE-2025-30066 exploited that gap.
How to Install the Snyk CLI (npm, Homebrew, and Standalone Binary)
Step-by-step ways to install the Snyk CLI on macOS, Linux, and Windows using npm, Homebrew, Scoop, or a standalone binary, plus how to authenticate and use it in CI.
Shifting security left: what it really means for teams
Shift left security means catching vulnerabilities at commit time, not audit time. Here's what that requires in practice, with real CVEs and numbers.
How to Sandbox Python Code Safely: A Security Guide
A security guide to running a Python sandbox: why language-level restriction fails, and the OS and runtime isolation that actually contains untrusted code.
npm Trusted Publishing walkthrough: retiring long-lived publish tokens
npm Trusted Publishing replaces long-lived publish tokens with short-lived OIDC-issued credentials tied to a specific CI workflow. Here is the 2026 rollout state, what the migration actually looks like, and where the rough edges still are.
node-jose Security: Using Cisco's JOSE Library Safely
node-jose is Cisco's JavaScript implementation of the JOSE standards for signing and encrypting tokens. Here is the CVE-2017-16007 invalid-curve flaw and how to use JWE and JWS defensively.
DevOps Security Best Practices: Shifting Left Without Slowing Down
Shift left fails when it means shifting friction left. Here are the DevOps security best practices that catch issues early while keeping pipelines fast enough that engineers leave the gates on.
npm provenance attestations walkthrough for 2026
npm provenance ties a published package to the specific GitHub Actions run that built it, signed through sigstore. Here is how to enable it for a publisher, verify it on the install side, and enforce it in CI without breaking your release process.
Flux CD vs Argo CD: Security Comparison for 2026
A security-focused comparison of Flux 2.5 and Argo CD 3.1: trust models, multi-tenancy, secret handling, signature verification, and the operational differences.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.