DevSecOps
In-depth guides and analysis on devsecops from the Safeguard engineering team.
497 articles
How to set up SAST scanning in a GitHub Actions pipeline
A step-by-step guide to setting up SAST scanning in GitHub Actions with CodeQL and Semgrep, including config, gating, and troubleshooting tips.
CI/CD Security Tools, Organized by Pipeline Stage
A stage-by-stage map of CI/CD security tools — from pre-commit hooks to runtime protection — so you know which control belongs where instead of bolting everything onto one gate.
How to set up DAST scanning in a CI/CD pipeline
A practical guide to building a DAST scanning CI/CD pipeline with OWASP ZAP — setup, integration, rule tuning, and troubleshooting for real deployments.
The DevSecOps Metrics That Actually Predict Breaches
Finding counts and scan totals are vanity metrics. The numbers that correlate with real incidents measure exposure time, coverage gaps, and gate bypasses.
Tekton Pipelines Hardening Guide
A practical hardening guide for Tekton Pipelines covering TaskRun isolation, step image provenance, workspace secrets, and the CVE history that shaped the current defaults.
CI/CD Compromise Investigation Steps
A step-by-step investigation playbook for suspected CI/CD pipeline compromise, from runner forensics to secrets rotation.
Argo CD GitOps Security Guide
Securing Argo CD deployments with RBAC, SSO integration, secret management, and network policies for production Kubernetes clusters.
How to Set Up Sigstore in Your Build Pipeline
Wire Sigstore into GitHub Actions end-to-end: OIDC identity, Cosign signing, Rekor transparency, and policy-controller enforcement — with working snippets.
AWS SAM Template Security Considerations
SAM templates look simple and that is exactly the problem. The defaults are generous, the transforms are opaque, and the resulting stacks are often more privileged than anyone intended.
Earthly Reproducible Builds and Security
How Earthly's reproducible, containerized build system eliminates environment drift and strengthens build integrity for security-conscious teams.
Supply Chain Security KPIs for Engineering Leaders
If you cannot measure your supply chain security posture, you cannot invest in it. Here are the KPIs that separate real programs from the theater.
Multi-Stage Docker Builds: The Security Implications Nobody Talks About
Multi-stage builds reduce image size, but they also introduce security considerations around build secrets, layer caching, and dependency leakage.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.