secrets
Safeguard articles tagged "secrets" — guides, analysis, and best practices for software supply chain and application security.
32 articles
How .dockerignore Protects Your Builds: A Security Guide
A well-written docker ignore file keeps secrets, git history, and local cruft out of your images — one of the cheapest and most overlooked container security wins.
Azure DevOps Personal Access Tokens in 2026: Rotation, Scoping, and Replacement
PATs remain the most common credential leak in Azure DevOps incidents. We trace the patterns that actually reduce risk and the migration paths that retire them entirely.
Docker BuildKit Security Best Practices for 2026
BuildKit has been the default Docker builder for years, but its security features remain underused. Here are the practices that matter in 2026.
What Is Key Management? Protecting the Keys That Protect Everything
Key management is the discipline of generating, storing, rotating, and retiring cryptographic keys safely. Strong encryption is only as good as the way its keys are handled.
Gitleaks Secret Scanning Recipes for 2026
Practical Gitleaks configurations and workflows for 2026, including pre-commit setup, monorepo tuning, custom rules, and how to avoid the false-positive treadmill.
Dev Machine Secrets: The Exfiltration Risks
Engineer laptops are the softest target in most organizations. Here is a senior engineer's look at the real exfiltration paths for developer secrets and how to shut them down.
Secrets Rotation Across Microservices: A Playbook
A practical senior engineer's playbook for rotating secrets across microservices without downtime, drift, or the quiet credential leaks that come from half-done cutovers.
age + SOPS: A Git-Native Secrets Workflow
How age and SOPS together deliver a lightweight, auditable, Git-native secrets workflow that stands up to real production use without a vault server.
AWS SSM Parameter Store Security
Parameter Store is everywhere in AWS workloads, which means it accumulates secrets, configuration, and bad IAM over time. Here is the security review I run on every Parameter Store deployment.
How to Rotate Leaked Secrets With Automation (2026)
The 2026 playbook for automated secret rotation: detection pipelines, credential broker patterns, blast-radius analysis, and CI integration that actually holds up in production.
CyberArk Conjur for Enterprise Secrets Management
Where Conjur fits in 2024 for enterprise secrets management, what it does well, where it hurts, and how to roll it out without drowning the platform team.
External Secrets Operator: A Kubernetes Guide
A senior engineer's walkthrough of External Secrets Operator, covering architecture, SecretStore design, rotation, and the patterns that hold up in production.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.