DevSecOps
In-depth guides and analysis on devsecops from the Safeguard engineering team.
497 articles
What is a Security Champion Program
A security champion program embeds trained developers in each engineering team to triage vulnerabilities locally. Here's how to structure, staff, and measure one.
Secure Defaults for Internal Developer Platforms
An IDP that makes the secure path the easy path wins. One that requires engineers to opt into security loses. Here is how to ship defaults that actually stick.
Building a DevSecOps Culture: Beyond Tools and into Teams
DevSecOps is a culture shift, not a tooling decision. Practical strategies for building security into development teams without creating friction or resentment.
How to Enable Dependency Review on GitHub PRs
A step-by-step tutorial for turning on GitHub Dependency Review, enforcing license and severity policies, and getting fast feedback on every pull request.
SBOM Tooling Landscape in 2023: What Actually Works
The SBOM tooling ecosystem has matured significantly, but choosing the right tools still requires understanding the tradeoffs between formats, generators, and analysis platforms.
GitHub Packages Security Features: What You Get and What You Do Not
GitHub Packages integrates tightly with GitHub Actions and repositories. Its security features are convenient but have gaps that teams need to understand.
Runtime SBOM vs. Build-Time SBOM: Which Do You Actually Need?
Build-time SBOMs capture what goes into your software; runtime SBOMs capture what actually runs. Understanding the difference is critical for accurate vulnerability management.
Bitbucket Pipelines Security Guide
Securing Bitbucket Pipelines with secure variables, deployment permissions, and pipeline hardening.
Dev Container Security Posture (incl. Dotfiles)
Dev containers promise reproducibility and isolation. They also pull in a long tail of scripts, dotfiles, and feature repos that most teams never audit. Here is how to fix that.
DevSecOps Toolchain Integration Patterns That Actually Work
Most DevSecOps tool integrations fail because they are bolted on rather than designed in. Here are integration patterns that provide security value without breaking the developer experience.
GitHub Dependabot and the State of Automated Dependency Security
Dependabot has become the default for dependency updates, but its limitations highlight why automated scanning alone isn't enough for supply chain security.
What is a Security Gate
A security gate blocks a build or deploy the moment it fails a policy check. Here's what gates actually check, where to place them, and why most fail.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.