Security Guides
Safeguard articles tagged "Security Guides" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Who should click accept on a developer tool's terms in a school?
Clicking accept on terms of service creates a contract. Learn the Department of Education advice on click-wrap terms and a simple rule for tool approvals.
Who should be on an AI security tool evaluation team?
Six roles belong on an AI security tool evaluation: security, platform, an ML engineer, compliance, a developer and procurement. What each one checks.
Who should be on a security tool trial team?
A security tool trial needs five roles: lead, triager, developers, integration owner and approver. Here is what each does and the time to budget for them.
Who should attend a security postmortem meeting, and who should not?
Invite the incident commander, service owners, key responders and the managers who can fund fixes. Keep it short. A published guide uses 15 to 30 minutes.
Who should approve an AI agent's access request?
Who signs off when an AI agent asks for access? Split approval between the data owner, a security reviewer and the agent's sponsor, as this guide shows.
Who should approve a new plugin: the user, an admin or security?
Match approval to access. A decision guide for when users can self install, when an admin must approve and when security reviews, with a tier table.
Who should approve a new dependency? A decision guide
Not every dependency needs a committee. A tiered approval guide shows which additions a developer can make alone and which need a named second reviewer.
Who is responsible for security on a client site: host or agency?
Hosts generally secure the infrastructure; the site owner and agency secure the application, plugins, accounts and content. Split the duties in writing.
Who retires an RPA bot? An offboarding checklist
Bots outlive their builders and keep working with valid access. Use this checklist to retire an RPA bot cleanly, from owner check to credential revocation.
Who should read the security advisory feeds? Set up an intake rota
Advisory feeds fail when they belong to everyone. Set up a weekly intake rota with a reader, a backup, a source list and a ten minute handoff note.
Who rated this finding: NVD, the CNA, or the advisory author?
OSV severity entries can name their source: NVD, CNA or SELF. Why the source matters when two scores disagree, and how to pick one for your gate.
Who pays for security fixes: the product team or a central budget?
Compare three funding models for security fixes, product team owned, central pool and hybrid, with the tradeoffs engineering managers should weigh.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.