Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A major release signals incompatible changes. Learn how to test a scanner upgrade in report mode so output, flags and gates do not break your builds.
RFC 9068 sets the required claims for JWT access tokens and the checks an API must run, including the at+jwt type and audience. A quick reference.
Compare a weekly update day with continuous dependency updates on review load, interruptions and security lag, and pick a cadence that suits your team.
Retry failed webhooks with exponential backoff and jitter over several days, keep the same event id, and avoid retry storms on recovering receivers.
Use webhooks for speed and polling for certainty. A decision table, plus the hybrid pattern most reliable security automations end up with in practice.
Providers do not guarantee webhook order. Dedupe by event ID, fetch current state from the API, and never rely on arrival order or timestamps alone.
The signature counter helps spot cloned authenticators, but zero values and race conditions are normal. How the W3C spec says to compare and respond.
A passkey is scoped to a relying party ID, which is a domain. That is why fake sites cannot use it. How RP ID and subdomains work, and what to choose.
Passkey support means verifying more than a signature. The W3C WebAuthn spec lists the registration checks: challenge, origin, RP ID hash, flags and more.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
