devsecops
Safeguard articles tagged "devsecops" — guides, analysis, and best practices for software supply chain and application security.
868 articles
Push Protection Stops the Next Secret, Not the 500 Already in Your History
Blocking a credential at git push is genuinely good and solves exactly one half of the problem. The other half is every commit you have ever made, and deleting those commits is not the fix either.
Your DAST Scan Has Six Timeouts and No Deadline
Per-phase timeouts add up. Six phases capped at ten minutes each is a sixty-minute scan wearing a ten-minute label — and the phase that mattered gets whatever is left.
The AI Code Percentage On Your Dashboard Is a Floor, Not a Measurement
Commit-level attribution answers 'lines added by commits an assistant co-authored'. That is a different sentence from 'lines an AI wrote', and the gap between them is where governance metrics go wrong.
Your Git History Already Knows Which AI Wrote Your Code
Coding assistants sign their own work in the commit trailer block. That makes 'how much of this was AI-written' a parsing problem, not a heuristic one — as long as your tooling reads the commit body, which most of it does not.
Your Dependency Incident Runbook Assumes a Fixed List of Bad Packages
Most supply chain runbooks say: get the affected package list, search lockfiles, remediate. Against a worm that adds packages while you work, every one of those steps is wrong.
AI Writes Code Faster Than You Can Review It. Which Scanner Do You Point at It?
AI-generated code arrives faster than review can absorb and fails in distinct patterns. SAST, DAST, and reachability each catch part of that — and each misses a specific, predictable slice.
Your DAST Scanner Was Built to Crawl Links. Your Application Doesn't Have Any.
Classic DAST discovers attack surface by following hyperlinks. In an estate of APIs and serverless functions there is nothing to crawl, so the scan completes, reports clean, and covers little.
How to vet open source software before deployment in tele...
A seven-step process for vetting open source telecom core network components — SBOMs, signature verification, protocol fuzzing, and procurement sign-off — before they reach production.
npm CLI Login in CI: Tokens, npm-cli-login, and Safer Patterns
The npm-cli-login package automated interactive npm login for CI pipelines — a pattern that npm's 2025 authentication overhaul has made both broken and unnecessary. Here is what to use instead.
Step-by-step guide to hardening and securing an MCP serve...
A practical, step-by-step guide to hardening and securing an MCP server deployment -- authentication, sandboxing, network policy, and monitoring included.
Comparing MCP security scanning and gateway products
A practical buyer's guide to MCP security gateways and scanners — evaluation criteria, honest strengths and gaps for real vendors, and where Safeguard fits.
Overview of AI model supply chain security risks end to end
A concrete, incident-driven walkthrough of AI supply chain security — from poisoned datasets and backdoored Hugging Face models to CI pipeline hijacks — and how to reduce the risk end to end.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.