Security Guides
Safeguard articles tagged "Security Guides" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Why are default logins in tutorials a problem, and what to use instead?
Tutorials that ship admin/admin or a shared demo password teach readers to leave defaults in place. Generate a unique password at first run instead.
Why do some projects not publish a severity score for their CVEs?
The Go team issues CVEs without severity labels or CVSS scores because impact depends on how you use the code. What that means for how you triage.
Why do security checks fail CI builds? A cause taxonomy
Security checks fail CI builds for five different reasons. Sort them into a taxonomy so your failure metrics point at the right owner and the right fix.
Why do scan results change when no code changed?
Scan results change without code changes because advisories, scores, exploit data and tool rules update. Learn five causes and how to explain them.
Why do people log in as the bot account, and how do you stop it?
Staff sign in as a bot account to debug or to skip an approval. That hides who acted and spreads the password. Here is how to stop it without slowing work.
Why do developers skip the paved road, and how do you fix it?
Developers leave a paved road when it is slow, rigid or opaque. Five causes drawn from DORA research on platform engineering, and a fix for each.
Why do apps keep asking for security updates when nothing seems wrong?
Apps need regular security updates because flaws are found in old code and in the parts inside the app. Here is why updates keep coming and what to do.
Why did my CI OIDC login to the cloud fail? A troubleshooting guide
When a CI job cannot assume a cloud role through OIDC, check the token permission, audience, subject format and trust conditions in that order.
Why did an unchanged container image gain new vulnerabilities?
An image that has not changed can still show new findings because advisory data changed, not the image. Here is how to tell the causes apart and respond.
Why did a vulnerability's severity change overnight in my scanner?
Scanner severity is borrowed data. Why it changes overnight after CNA scores, NVD corrections or re-enrichment, and how to write policy that copes.
Why do DAST scanners rarely find insecure deserialization?
Insecure deserialization needs format knowledge, a gadget chain and often an out-of-band callback. Why black-box scans miss it and what finds it instead.
Why is CAP_SYS_ADMIN the capability to avoid in containers?
The Linux manual calls CAP_SYS_ADMIN overloaded. Learn what it allows, which capabilities were split from it and how to ask for something narrower.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.