devsecops
Safeguard articles tagged "devsecops" — guides, analysis, and best practices for software supply chain and application security.
868 articles
DevOps Measurements: Metrics That Actually Matter
The DevOps measurements worth tracking tie delivery speed to stability and security. Here are the ones that change decisions, not just dashboards.
Detecting vulnerabilities in multi-stage Docker builds
Multi-stage Docker builds hide vulnerabilities, leaked secrets, and untracked dependencies in discarded layers. Here's what final-image scans miss and how to catch it.
DevSecOps and CI/CD pipeline security
CI/CD pipelines are now a prime attack surface. Here's what Checkmarx's SAST-first approach misses, and how Safeguard secures the full pipeline.
Keeping Docker secrets secure without Kubernetes
Docker ships with tmpfs-backed Swarm secrets, BuildKit secret mounts, and Compose file secrets — here's how to use them without Kubernetes.
Reducing developer friction in AppSec adoption
Why traditional SAST tooling like Checkmarx creates developer friction, what it costs engineering teams, and how to build developer experience application security that ships.
Docker Architecture Explained: A Security-Focused Breakdown
Docker architecture is a client-server system built on the daemon, containerd, images, and the kernel features that isolate containers. Here is how the pieces fit and where the security lines are.
Repository health and source-code manager (SCM) risk
Repository health—branch protection, stale permissions, leaked secrets, OAuth grants—is a supply chain risk AppSec scanners like Checkmarx can't see. Here's why it matters.
Snyk and GitHub Actions: How to Wire Up CI Scanning
How to set up Snyk in GitHub Actions the right way — the official actions, storing your token, uploading SARIF to code scanning, and gating pull requests.
What is Static Application Security Testing (SAST)
SAST scans source code for flaws before deployment. Learn how it works, where Checkmarx-style tools fall short on supply chain risk, and how Safeguard closes the gap.
OCI image vulnerability scanning explained
A concrete breakdown of how OCI image vulnerability scanning works, where scanners miss real risk, and how to build a scan workflow that doesn't drown teams in noise.
Static Analysis Tools compared
Veracode built its name on SAST, DAST, and SCA for application code. Safeguard focuses static analysis on the software supply chain. Here's how the two actually differ.
Reducing CVEs in container base images
Base images inherit hundreds of OS-level CVEs your app never touches. Here's how reachability analysis and minimal bases cut real risk, not just counts.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.