best-practices
Safeguard articles tagged "best-practices" — guides, analysis, and best practices for software supply chain and application security.
108 articles
Container Security Best Practices for 2025: Beyond Image Scanning
Container security has evolved far past vulnerability scanning. Here is what mature container security programs look like heading into 2025.
Vulnerability Burndown Charts That Actually Work
Most burndown charts lie about progress. Here is how to build one that survives executive scrutiny by combining reachability, age cohorts, and inflow data.
AWS IAM Roles Anywhere and the Supply Chain
IAM Roles Anywhere lets workloads outside AWS assume IAM roles using X.509 certificates. It is also becoming the authentication layer for supply chain tools. Here is what the threat model looks like.
AWS SSM Parameter Store Security
Parameter Store is everywhere in AWS workloads, which means it accumulates secrets, configuration, and bad IAM over time. Here is the security review I run on every Parameter Store deployment.
Azure App Service Deployment Security
App Service deployments are easy, which is the problem. A look at the deployment paths, credential surfaces, and hardening steps that matter for production workloads.
GCP Pub/Sub Security Configuration
A working security configuration for GCP Pub/Sub: topic and subscription IAM, message encryption, VPC Service Controls, dead-letter handling, and the failure modes that turn a messaging layer into an attack surface.
Triage Hand-Off From Security To Engineering
The handoff between security triage and engineering remediation is where most programs lose time. Here is how to fix it with context-rich PRs and AI.
Doppler Enterprise Secrets Platform Reviewed
Doppler pitches itself as the secrets platform that gets out of developers' way. A detailed look at what works, what does not, and the trade-offs against Vault, Infisical, and the cloud-native options.
Vendor Offboarding and Supply Chain Data Destruction
A practical playbook for offboarding software vendors and ensuring data is actually destroyed, not just promised to be destroyed, across complex subprocessor chains.
Dependabot Noise Reduction Techniques For 2026
Dependabot is useful when tuned and a productivity tax when not. Here are the noise reduction techniques that actually work in modern monorepos.
Procurement Security Questionnaires That Actually Work
How to design a supplier security questionnaire that produces usable signal, what to cut from standard templates, and how to integrate the output into real risk decisions.
AWS Step Functions Workflow Security
Step Functions workflows orchestrate everything from data pipelines to security automations. The workflow IAM role is almost always the most powerful thing in the stack. Here is how to lock it down.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.