DevSecOps
In-depth guides and analysis on devsecops from the Safeguard engineering team.
497 articles
How to Build a Secure Python URL Validator (and Avoid SSRF)
A Python URL validator has to do more than match a regex. Here is how to validate URLs safely, block SSRF, and pick between urllib, validators, and Pydantic.
netty-codec-http2 in Maven: Vulnerabilities and Fixes
The netty-codec-http2 Maven artifact powers HTTP/2 in gRPC, Spring, and countless services. Here are the CVEs that matter, the safe versions, and how to find it in your tree.
Runbooks for Dependency Disclosure Events
Detailed runbooks for responding to dependency CVE disclosures across languages and ecosystems, with roles, commands, and timelines tuned for automation.
Is node:18-alpine Still Safe to Use in 2025?
The node:18-alpine image is small and popular, but Node.js 18 reached end of life in April 2025. Here is what that means for your containers and how to migrate cleanly.
node:20-alpine: Is the Small Image Worth the Tradeoffs?
node:20-alpine gives you the smallest mainstream Node.js base image, but musl libc and a stripped userland come with real caveats. Here is when to use it and how to harden it.
The Java Cheat Sheet Developers Actually Need for Secure Code
Most Java cheat sheets stop at syntax. This one is the security-focused reference: the APIs, patterns, and one-liners that keep injection, deserialization, and crypto bugs out of your code.
Argo CD Image Updater Security Considerations in 2026
How Argo CD Image Updater works, the security tradeoffs of automated image promotion, and the configuration patterns that prevent supply chain incidents.
Azure DevOps Pipeline Supply Chain Hardening 2026
A 2026 hardening guide for Azure DevOps Pipelines: service connections, workload identity federation, approval gates, agent isolation, and SLSA integration.
Bun vs Node: A Practical Comparison for 2025
Choosing between Bun vs Node comes down to speed, compatibility, and how much you value a mature ecosystem. Here is an honest breakdown, with Deno in the mix.
Security Testing in the Software Development Lifecycle
Security testing for software development only works when it's distributed across the SDLC, not bolted on as a single pre-release gate — here's where each test type actually belongs.
maven-assembly-plugin: A Security Guide
The maven-assembly-plugin bundles your project into distributable archives. It builds archives rather than extracting them, which shapes exactly which supply chain risks apply to it.
Choosing Secure Node.js Docker Images
How to pick Node.js Docker images that stay small and secure: comparing slim, Alpine, and distroless variants, pinning versions, and scanning for CVEs.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.