runtime-security
Safeguard articles tagged "runtime-security" — guides, analysis, and best practices for software supply chain and application security.
62 articles
Best Kubernetes Security Tools in 2026: A Buyer's Guide
A balanced buyer's guide to the best Kubernetes security tools in 2026 — Aqua, Sysdig, Falco, Kubescape, Trivy, and Wiz — covering image scanning, admission control, runtime detection, and KSPM, plus where Safeguard fits.
Bun Security Best Practices (2026)
Bun is fast and Node-compatible, but unlike Deno it has no permission sandbox. Here is how to run it safely: trusted-dependency script blocking, frozen lockfiles, and real dependency auditing.
Deno Security Best Practices (2026)
Deno is secure by default, but its permission model only protects you if you use it deliberately. Here is how to run Deno with least privilege and keep its dependency graph clean.
Docker Security Pro Tips: Hardening Beyond the Basics
You already use a non-root user and a slim base. These are the pro-level Docker hardening tips — read-only filesystems, dropped capabilities, and the docker.sock trap — that actually stop breakouts.
Container configuration drift detection at runtime
Container images pass CI clean, but running containers drift within hours via exec sessions, sidecars, and webhooks. Here's how to detect it at runtime.
CVE-2019-1075: Denial of service in .NET Core
CVE-2019-1075 is a 2019 denial-of-service flaw in .NET Core that let unauthenticated attackers crash web apps with crafted requests. Here's what to know.
eBPF Rootkits Go Mainstream: Inside IronWorm and the Kernel-Level Turn in Supply Chain Malware
IronWorm shipped a kernel-level eBPF rootkit inside dozens of npm packages, hiding the very processes your security tools rely on seeing. Here is what changed, and how to detect kernel-level supply chain malware before it blinds you.
Runtime Threat Detection in Cloud-Native Environments
Static analysis catches known vulnerabilities. Runtime detection catches exploitation. Here is how to implement runtime threat detection for containerized workloads.
Is Node.js Safe? A Security Guide for Production Apps
Is Node.js safe to run in production? The runtime itself is well maintained and secure by modern standards. The real risk lives in the dependency tree and how you configure the app around it.
eBPF and OpenTelemetry: The New Instrumentation Layer for...
eBPF and OpenTelemetry are becoming AppSec's new runtime instrumentation layer, catching supply chain attacks like the xz backdoor that static scanners miss entirely.
How to Evaluate a Docker Security Company
Picking a Docker security company means judging vendors on the whole container lifecycle — image scanning, runtime, registry, and admission — not just the count of CVEs their scanner prints. Here is a buyer's checklist.
Kubernetes SecurityContext, Field by Field
SecurityContext in Kubernetes is where pod and container hardening actually lives — here's what each field controls and which defaults you should never leave in place.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.