Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
When the flag provider is down, SDKs use default values. Choose them on purpose: safe defaults for security flags, cached values, and how to test it.
A permissioning flag decides who sees a feature, but the server must still enforce who can use it. Where to put flag checks and where to put access checks.
The evaluation context decides who sees a feature. Send a stable ID and a few coarse attributes, and keep emails, tokens and personal data out of it.
How to keep tests that need keys and tokens from tripping secret scanners or leaking real ones: obvious fakes, generated values and allowlists.
Record a baseline run, compare each new scan to it, and fail only on findings not in the baseline. The count can then only go down. Here is the setup.
Extending versus customizing the Airflow image, seen through patching and pinning: constraints, same-version installs, non-root pip, and regular rebuilds.
Operators need to see which flags are on in each environment, but a public endpoint leaks unreleased features. How to build a flag status view safely.
Over the air updates push new JavaScript to installed apps. Code signing lets the app reject tampered updates. How the keys work and how to rotate them.
Two ways to deal with a vulnerable transitive library in Maven: exclusions to remove it, or dependencyManagement to pin a fixed version. When to use each.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
