Security Guides
How should RPA bots store credentials safely?
Keep bot passwords and keys in a managed secret store, not in workflow files, shared drives or spreadsheets. Here is a practical setup and rotation habit.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How should ephemeral CI runners reach private networks safely?
Put CI runners in their own network segment and allow only the routes each job needs. Here is how to reach internal services without a flat network.
Oct 19, 20263 min read
Security Guides
How should ephemeral CI jobs authenticate to a private registry?
Give each job a short-lived, read-only registry credential at start, never a login saved on the runner. Here is how to pull and push without shared secrets.
Oct 19, 20263 min read
Security Guides
How should docs show API keys in code samples?
Show API keys in docs as obvious placeholders read from environment variables, never as realistic looking strings or real test keys. Here is the pattern.
Oct 19, 20264 min read
Security Guides
How should a webhook sample in docs verify the sender's signature?
A webhook sample that skips signature checks teaches readers to trust any caller. Verify an HMAC over the raw body and compare it in constant time.
Oct 19, 20264 min read
Security Guides
How should a vulnerability scan job queue be designed?
A scan job queue needs idempotent jobs, dedupe keys, priorities, visibility timeouts and a dead-letter path. Here is the minimum design for platform teams.
Oct 19, 20264 min read
Security Guides
How should a small team scope its first penetration test?
Scope one internet facing app, set goals and rules of engagement, fix easy issues first, and plan a retest. A practical scoping guide for small teams.
Oct 19, 20264 min read
Security Guides
How should a mobile app log out and revoke its OAuth tokens?
Deleting tokens from the phone is not logout. Call the revocation endpoint from RFC 7009 so the server kills the refresh token and related access tokens.
Oct 19, 20264 min read
Security Guides
How should a maintainer step away from an open source project safely?
Stepping away from a project safely means choosing a successor, handing over access deliberately, documenting intent and linking active forks.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.