Security Guides
How do runner groups limit who can use a self-hosted runner?
Runner groups decide which repositories can send jobs to a shared self-hosted runner. How the default group works and how to tighten access.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Who can read your GitHub Actions secrets?
Anyone with write access to a repository can read its Actions secrets through a workflow. Here is who that covers and how to shrink the group.
Oct 19, 20264 min read
Security Guides
Which GitHub repository roles can manage Actions secrets?
Read and Triage cannot touch Actions secrets; Write, Maintain and Admin can create, update and delete them. Why it matters and how to narrow exposure.
Oct 19, 20263 min read
Security Guides
Who should be able to read a supply chain postmortem?
Share the lessons widely and keep secrets, live weaknesses and personal data restricted. A simple two layer approach to supply chain postmortem access.
Oct 19, 20263 min read
Security Guides
Who can reach the Kafka Connect REST API on port 8083?
Kafka Connect's REST API defaults to HTTP on port 8083 and manages connectors at runtime. Bind it, enable HTTPS, restrict the network, review access.
Oct 19, 20264 min read
Security Guides
Who should be allowed to invite outside collaborators to your repos?
By default any repository admin can invite outside people. Learn the setting that narrows it to owners, who it applies to, and an intake process that fits.
Oct 19, 20264 min read
Security Guides
Who should be allowed to change your package mirror or approved list?
Whoever can change the mirror can change what every build installs. How to restrict, separate and log edit rights on the mirror and the approved list.
Oct 19, 20263 min read
Security Guides
Why do buyers ask who can deploy to production, and what to show?
Buyers ask who can change production because the pipeline is part of your supply chain. Show an access list, approval rules and a deploy log to answer.
Oct 19, 20264 min read
Security Guides
Who should be allowed to change a remediation automation setting?
The setting that controls how much a fix bot can do is itself a production change. How to restrict it, require a second person, and keep a record.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.