DevSecOps
In-depth guides and analysis on devsecops from the Safeguard engineering team.
497 articles
Buck2 (Meta) Build Security Considerations
A security engineer's look at Buck2, Meta's open-source build system, including Starlark sandbox properties, remote execution, and actual supply chain guarantees.
go generate Supply Chain Risks
go generate is a seam where arbitrary commands run with the full privileges of the developer, and it does not show up in any manifest of trusted dependencies.
GitHub Actions Supply Chain Hardening Checklist 2026
A pragmatic 2026 hardening checklist for GitHub Actions: OIDC, pinned actions, environment protection, reusable workflows, and the controls that actually move risk.
How to Rotate Build Signing Keys Safely
A step-by-step tutorial for rotating Cosign and GPG build signing keys without breaking existing attestations, verification chains, or downstream consumers.
Docker Hub Rate Limit Changes and CI Impact
Docker's 2024 rate-limit reforms hit CI pipelines hard. Measured impact on 30 real build farms and the mirror and pull-through controls that fixed it.
GraphQL Supply Chain Security Considerations
Supply chain risks specific to GraphQL stacks: Apollo, graphql-js, persisted queries, introspection, and transitive risk in gateway federation.
Cloud IAM And Supply Chain Overlap Mistakes
Cloud IAM and supply chain controls overlap in ways that confuse most teams. These are the 2026 mistakes that turn IAM gaps into supply chain incidents.
GitHub Codespaces and Supply Chain Risk in 2026
Codespaces shifts development from the laptop to the cloud, which changes the supply chain threat model in ways most teams have not fully thought through.
snyk test and snyk code test: Command Guide with Examples
snyk test scans your dependencies; snyk code test runs SAST on your own source. Install, auth, flags, CI exit codes, and the gotchas between the two commands.
AWS CDK Construct Library Security
CDK constructs are code that provisions infrastructure. Most teams audit the infrastructure but not the constructs. Here is how to think about construct library security and what to check.
GitGuardian vs TruffleHog: Secret Detection Showdown
Compare GitGuardian and TruffleHog on detector coverage, validation, historical scans, developer workflow, and pricing to pick the right secret scanning tool.
Developer Onboarding Supply Chain Controls Template
The first week is when developers form their habits. A template for onboarding new engineers into supply chain controls without overwhelming them.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.