Security Guides
Which Linux kernel CVEs actually apply to your embedded device?
The kernel team assigns CVEs to nearly every fix, so many do not affect your build. Narrow the list by supported version, config and reachability.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you connect your SBOM to a vulnerability response story?
An SBOM alone is a list. Buyers want to hear what you do when a component is hit by an advisory. Here is a six step response story a startup can tell.
Oct 19, 20264 min read
Security Guides
How do you tie risk exceptions to SBOM components so they expire?
Record each exception against a package URL and version range with an owner and an expiry, so an SBOM diff reopens it when the component changes.
Oct 19, 20263 min read
Security Guides
Open source license scanning: ten quick answers to common questions
Ten short answers on license scan reports: what is detected, what unknown means, what to do with OR expressions, notices, and what to record.
Oct 19, 20263 min read
Security Guides
A scan says a license is unknown. What are the first five steps?
When a scanner reports an unknown license, check the package files, the source repo, the registry page and the maintainer, then record the outcome.
Oct 19, 20263 min read
Security Guides
Licence review or security review first for a new open source package?
Run licence and security review in parallel from one request, with separate owners and records. A simple two-gate flow for regulated teams to use.
Oct 19, 20263 min read
Security Guides
Is 'approve with comments' safe when the comment is a security issue?
Approve with comments speeds up review across time zones, but security findings need care. A simple rule for which comments can ride along with approval.
Oct 19, 20264 min read
Security Guides
Let's Encrypt certificates are getting shorter: what should you do?
Let's Encrypt is cutting certificate lifetimes from 90 days to 45 by 2028. Small sites with manual renewal need a plan. Here is a short checklist.
Oct 19, 20263 min read
Security Guides
What can a runaway automation incident teach about safe remediation?
Google's published case: an empty list read as no filter erased disks globally. Lessons on idempotency, rate limits and cross-checks for any automation.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.