DevSecOps
Node.js vm Module Security: Why It Is Not a Sandbox
The Node.js vm module runs code in a separate V8 context, but it is not a security sandbox. Here is why untrusted code can escape it and what to use instead.
Jul 22, 20256 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDevSecOps
How to Choose a Python Code Checker for Secure Code
A Python code checker is more than a linter. Here is how the layers fit together, which open-source tools do what, and where online checkers help and hurt.
Jul 22, 20256 min read
DevSecOps
@types/node Explained: What the Package Does and Why It Matters for Security
@types/node is the TypeScript definitions for Node.js, pulled from DefinitelyTyped. Here is how it works, why version drift causes headaches, and its real supply-chain footprint.
Jul 22, 20256 min read
DevSecOps
How to Uninstall Java Safely on Windows, macOS, and Linux
To uninstall Java cleanly you need to remove the runtime, clear leftover paths and environment variables, and confirm nothing critical still depends on it.
Jul 21, 20256 min read
DevSecOps
Shift Left Fatigue: Why Developers Are Pushing Back on Se...
Shift-left security handed developers new duties without removing old ones. Here's why teams are pushing back — and how better tooling fixes the real problem: noise, not ownership.
Jul 19, 20257 min read
DevSecOps
Why Security Training Completion Rates Don't Predict Secu...
Completion rates measure attendance, not behavior. Here's why training checkboxes don't predict secure coding outcomes, and what to measure instead.
Jul 19, 20257 min read
DevSecOps
Friction as a Security Metric: Measuring Tool Adoption Fa...
Security tools fail quietly when developers route around them. Here's how to measure friction as a leading indicator of adoption failure before it causes a breach.
Jul 19, 20258 min read
DevSecOps
The Champion Model: Do Embedded Security Champions Actual...
Security champion programs cut vulnerabilities only under specific conditions. Here's what BSIMM, GitLab, and OWASP data show about when the champion model actually works.
Jul 18, 20257 min read
DevSecOps
Why Security and Engineering KPIs Are Still Misaligned in...
Security teams chase CVSS scores and SLA compliance while engineering chases velocity and uptime—two scorecards that were never built to agree.
Jul 18, 20257 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.