supply-chain-security
Safeguard articles tagged "supply-chain-security" — guides, analysis, and best practices for software supply chain and application security.
1045 articles
Threat Modeling for Developers
Threat modeling doesn't have to be a heavyweight ceremony run by a separate security team. Here's how developers can fold lightweight, per-feature threat modeling directly into pull requests and sprint work.
What Is Defense in Depth in Security?
Defense in depth is a layered security strategy that assumes any single control will eventually fail, so it stacks independent safeguards to slow and stop attackers. Here's how the model works and how it maps to the software supply chain.
What Is Safeguard? Common Questions Answered
A beginner-friendly FAQ explaining what Safeguard is, who it is for, what it protects against, and how it compares to the tools teams already use.
What GitHub Advanced Security actually includes now that ...
GitHub split Advanced Security into Secret Protection and Code Security in April 2025. Here's what each product covers, what it costs, and where the gaps still are.
GitHub Secret Protection deep dive: push protection, cust...
How GitHub Secret Protection's push protection, custom patterns, and validity checks actually work post-GHAS split, and where the coverage gaps still leave secrets exposed.
CI/CD Pipeline Security Best Practices for 2026
Your build pipeline is production-adjacent infrastructure with credentials to everything. Here are the CI/CD security practices — mapped to the OWASP Top 10 CI/CD risks — that actually close the gaps attackers use.
Attack Surface Reduction: A Practical Guide
Attack surface reduction is the discipline of removing every input, interface, and privilege an attacker could reach that your system does not actually need. Here's how to inventory, shrink, and keep it small.
DevSecOps Best Practices: A 2026 Implementation Guide
A practical, opinionated guide to the DevSecOps practices that actually reduce risk in 2026 — from shifting left correctly to policy gates, reachability, and measurable ownership.
.NET Security Best Practices for 2026
A practical .NET security playbook covering dependency risk, deserialization, secrets, cryptography, and CI/CD hardening, with the config flags and CVEs that make each control real.
Go Security Best Practices: A 2026 Field Guide for Backend Teams
Go ships secure defaults most other languages lack — but its supply chain, concurrency model, and cgo edges still leak real vulnerabilities. Here are the practices that actually move the needle.
Helm Chart Security Best Practices
Helm charts template every RBAC binding, image reference, and secret your cluster runs. Here is how to harden charts, verify provenance, and stop a templating tool from quietly shipping cluster-admin.
NIS2 Directive explained: the software and supply-chain obligations
NIS2 rewired EU cybersecurity law around supply-chain security, vulnerability handling, and 24-hour incident reporting. Here is who is in scope and what your software teams now have to prove.