Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Use a labeler workflow that maps changed file paths to labels, then route security review by label. Config example, limits and what labels cannot do.
A ten minute self-review checklist for authors covering size, description, tests, trust boundaries and dependencies, so reviewers spend time on judgment.
Unowned alerts sit idle. Assigning each alert to a person or team removes the wait for someone to pick it up. Here is how to set it up and check it works.
Ask a scanner demo to block and then allow a pull request using a rule you write. Here is a short test of policy gates, exceptions, and failure behavior.
NVD removed its legacy 1.1 feeds and CPE files on 20 August 2025. Here is how to check whether a script or scanner of yours still depends on them.
Yes. The push endpoint acts like a bearer token: anyone who has it can send to that browser. Learn how to store, log and revoke subscriptions safely.
Yes. A compromised action can reach every secret in a repository. Learn what GitHub says about the risk and how pinning, permissions and review reduce it.
Obsidian says it cannot restrict community plugins to specific permissions, so plugins inherit its access. What Restricted Mode does and how to decide.
No. Kubernetes ephemeral containers are a debugging feature inside an existing pod. Ephemeral CI runners are single-use job environments. Do not mix them up.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
