secrets-management
Safeguard articles tagged "secrets-management" — guides, analysis, and best practices for software supply chain and application security.
102 articles
Measuring Developer Security Maturity Beyond Tool Coverage
Tool coverage tells you what's installed, not whether developers are actually getting safer. Here's how to build a maturity model around remediation velocity, recurrence, and secrets hygiene instead.
8 tips for securing your CI/CD pipeline
Real incidents like tj-actions and xz-utils show how CI/CD pipelines get compromised. Eight concrete, actionable tips to lock yours down.
Secrets management: tools and best practices
Secrets leak because of workflow gaps, not carelessness. Here's how vaults, scanners, and rotation policies actually stop credential exposure.
Finding and fixing exposed hardcoded secrets in GitHub projects
Hardcoded secrets leak into GitHub every day and get exploited within minutes. Here's how to find, fix, and prevent exposed credentials at scale.
Keeping secrets out of agent context windows: brokers, scoped tokens, and redaction
Every secret that touches an agent's context window is a secret the agent can leak. Just-in-time credential brokers, scoped-token issuance, and redaction layers keep the surface small without breaking the agent's ability to do real work.
dotenv npm: A Security Review and Safe Usage Guide
The dotenv npm package loads environment variables from a .env file into process.env. It is safe and widely used, but how you handle the file around it is where most mistakes happen.
Unsecured API Keys: How They Leak and How to Lock Them Down
Unsecured API keys are one of the most common causes of breaches, usually leaking through committed code and misconfigured storage. Here is how they get exposed and how to stop it.
CI/CD Cyber Security: Securing the Pipeline End to End
Your CI/CD pipeline holds the credentials, signs the artifacts, and deploys to production. Here is how to secure it against the attacks that target the build itself.
dotenv-webpack: How to Keep Secrets Out of Your Bundle
dotenv-webpack loads .env values into a webpack build, but it inlines them into client code at compile time, so anything you reference ships to the browser in plaintext.
Cloud Application Security Best Practices
Five layers cover most of the risk in cloud apps: identity, secrets, artifact scanning, pipeline gates, and runtime guardrails. Here is how to build each one without slowing delivery.
Kubernetes Secrets
Kubernetes Secrets are base64, not encrypted, by default. Here is how they actually leak, why scanners like Aqua fall short, and how to fix it.
Secure Usage of Authorized Code Repositories: A Practical Guide
Secure usage of authorized code repositories means controlling who can access source, protecting branches, scanning for secrets, and treating the repo as production infrastructure. Here is how.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.