ci-cd
Safeguard articles tagged "ci-cd" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Rego for intermediates: combining rules with AND/OR and writing actionable error messages
Rego has no `&&` or `||` operators — AND is implicit, OR means writing the same rule twice, and most teams miss both until a policy silently passes.
Reducing Docker image build time without sacrificing security
Multi-stage builds and minimal base images can cut CI build times dramatically — and they're the same changes that shrink your CVE attack surface.
DevSecOps for Beginners: Building Security Into How You Ship
DevSecOps sounds like a buzzword, but the idea is refreshingly human: make security a shared, everyday part of building software rather than a gate at the end. Here is a friendly introduction with a first step to try today.
What Is Shift-Left Security? A Plain-English Explanation
Shift-left security means moving security checks earlier in development — into the IDE, the commit, and the pull request — so flaws are caught while they're cheap to fix. Here's what it actually means and how to do it without slowing teams down.
Automated Pull Request Fixes FAQ: How Fix PRs Are Built, Tested, and Merged
What an automated fix pull request contains, how CI validates it, how auto-merge gating works, and which SCM platforms and review workflows are supported.
The Risks of Secrets in Environment Variables (2026)
Environment variables feel like the safe place to put secrets — but they leak through crash dumps, child processes, CI logs, and container layers. Here is where env-var secrets escape and what to do instead.
.NET Dependency Vulnerability Scanning: A Practical Guide
How to scan .NET dependencies for known vulnerabilities using dotnet list package, NuGet audit, and reachability-aware SCA, and how to wire it into CI so nothing ships with a known critical.
Shift-Left Security FAQ: 2026 Explained
Common questions about shift-left security answered for 2026 — what it means, why earlier is cheaper, how it works in practice, and how to avoid overwhelming developers.
DevSecOps FAQ: Practical Answers for 2026
Straight answers to common DevSecOps questions in 2026 — what it means, how it differs from DevOps, where security fits in CI/CD, and how to avoid slowing developers down.
GitHub Token Security (2026 Guide)
GitHub tokens are keys to your source, your CI, and often your cloud. This guide covers PATs, fine-grained tokens, GitHub App and Actions tokens — and how to scope, store, and rotate them after the CircleCI and Heroku token thefts.
Software Supply Chain Security for DevOps Teams
DevOps teams own the pipeline, and the pipeline is now the primary target. Here is how to secure build, artifact, and deploy without turning delivery speed into collateral damage.
The Best DevSecOps Tools in 2026
DevSecOps is a category with fuzzy edges. This balanced guide compares GitHub Advanced Security, GitLab, Snyk, Semgrep, Aqua, and Safeguard on how they actually fit into pipelines — with honest tradeoffs and a framework for choosing.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.