Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Set cert-manager duration and renewBefore with hours, not days, and keep renewBefore well below duration to avoid a constant renewal loop in production.
cert-manager 1.18.0 changed the default rotationPolicy from Never to Always. See what that means for key reuse, key pinning and your mTLS clients.
The cert-manager CSI driver gives each pod its own certificate with no Secret object. When it fits for mTLS, when a Certificate resource is better.
A finding you accepted in one scanner resurfaces in the other. Keep one decision record keyed on package, version and advisory, and port it to each tool.
SARIF has a suppressions property with kind, status and justification fields. Learn what it can carry between scanners and where it falls short.
Carry a local patch safely while upstream reviews it: keep it small, record it, pin the version, test on upgrade and delete it when the fix lands.
In Cargo.toml, log = 1.2.3 is a caret requirement. See which versions it allows, why 0.x crates behave differently, and what that means for updates.
Use the cargo update dry run option to see which crates would move before the lockfile is written, then review the changes like any other code change.
Cargo tree with the invert option shows every crate that depends on a flagged package, and the duplicates option exposes two versions. Steps to a fix.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
