DevSecOps
In-depth guides and analysis on devsecops from the Safeguard engineering team.
100 articles
The Python Pickle Exploit: Why Unpickling Untrusted Data Runs Code
A Python pickle exploit works because unpickling can execute arbitrary code during deserialization. Here is how the class works, why it is unavoidable by design, and what to use instead.
WebAssembly WASI Security Model in 2025
A technical look at WASI Preview 2, the component model, and capability-based isolation for running untrusted code inside supply chain tooling.
Embedding security-by-design into DevSecOps risk management across the SDLC
NIST's SSDF turns 'shift left' into eleven concrete practices — but a framework on paper doesn't stop a bad merge. Here's how to make it enforceable.
Hardening CI/CD Against a Compromised Upstream Registry
The Sept 2025 npm attack hit packages with 2B weekly downloads in 2 hours. Pinning, lockfile checks, and mirrors would have stopped it cold.
The DevSecOps metrics that actually indicate program maturity
CISA's KEV directive now demands 3-day fixes for the riskiest bugs. Here's why raw finding counts are the wrong way to measure a DevSecOps program.
A reference architecture for automating security gates in CI/CD
29M hardcoded secrets leaked in 2025 alone. Here's a gate architecture — SAST, SCA, secrets, IaC — that catches that without adding a day to your release cycle.
Why developers stop trusting AI-generated vulnerability fixes
Trust in AI-generated code fell to 29% in 2025, yet 84% of developers keep using it anyway — the gap is a UX problem, not a model problem.
Credential rotation playbook after npm worm exposure
A step-by-step rotation runbook for security teams exposed to the Shai-Hulud npm worm — what to revoke first, how to verify a credential is dead, and how to prevent a repeat.
Best secure software development lifecycle (SSDLC) platforms
A practical buyer's guide to SSDLC platforms in 2026 — evaluation criteria, an honest roundup of six real vendors, and where Safeguard fits in.
Security in the SDLC: Where It Actually Belongs
Bolting a scanner on before release doesn't count as shift-left. Here's where security actually needs to sit across the SDLC, and why mobile testing is often the weakest link.
Measuring AppSec ROI: Metrics That Prove Your Program Works
You cannot fund an application security program on fear forever. Here is how to measure AppSec ROI with metrics executives believe — cost avoided, MTTR, and the leading indicators that predict both.
DevSecOps Metrics and KPIs That Actually Prove Progress
Most security dashboards count findings and prove nothing. A 2026 guide to the DevSecOps metrics and KPIs that show real risk reduction — MTTR, escape rate, coverage, and DORA-aligned measures.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.