devsecops
Safeguard articles tagged "devsecops" — guides, analysis, and best practices for software supply chain and application security.
868 articles
jest-junit: Secure CI Test Reporting for Jest
jest-junit turns Jest test results into JUnit XML that CI systems can read. Here is how to configure it and keep the reporting pipeline free of security surprises.
ISO 27001 compliance for software development teams
ISO/IEC 27001:2022 audits now check 8 SDLC controls directly — SBOMs, vulnerability SLAs, and CI/CD evidence dev teams commonly get flagged on.
CI/CD pipeline dependency security integration coverage
How does Safeguard's pipeline-native dependency security compare to Socket.dev's PR-comment model? A concrete look at coverage, enforcement, and deployment options.
How to Build a Secure Python URL Validator (and Avoid SSRF)
A Python URL validator has to do more than match a regex. Here is how to validate URLs safely, block SSRF, and pick between urllib, validators, and Pydantic.
How to Choose an Application Security Company
What an application security company actually does, the categories of vendors, and the questions that separate real coverage from a dashboard full of noise.
Open Source Code Scanning: Tools and Workflow
Open source code scanning tools can cover most of a small team's needs for free, but the workflow around them — what runs where, and who reviews the output — matters more than which tool you pick.
The Core Pillars of DevSecOps, Explained
The DevSecOps pillars are the recurring foundations every mature program shares: culture, automation, shift-left testing, continuous monitoring, and shared measurement.
webpack-merge: What It Does and How to Use It Securely
webpack-merge cleanly combines webpack configs, but its low release cadence and function-executing merge behavior deserve a security-minded look.
Cloud Security and DevOps Automation: Building Guardrails Into the Pipeline
How cloud security and DevOps automation fit together: shifting checks into CI/CD, policy as code, automated IaC and image scanning, and the pitfalls that make automation give false confidence.
Rego Policy Language: How OPA Turns Rules Into Code
Rego is the declarative policy language behind Open Policy Agent. This guide explains how it works, where it fits in a security pipeline, and how to write policies you can trust.
AppSec Program Management: Building One That Sticks
AppSec program management is the discipline of turning scattered security tools into a governed, measurable program with owners, policies, and metrics. Here is how to build one.
Snyk REST API: How the Versioned Endpoints Actually Work
The Snyk REST API uses date-based versioning and a Bearer token, which trips up first-time integrators. Here is how it differs from the old v1 API and how to make your first call.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.