Security Guides
What belongs on a go/no-go checklist for a security upgrade?
A short go/no-go checklist for security upgrades: what to confirm before merge, before rollout and before you call the fix done, with stop rules.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you limit request body size in a Go HTTP handler?
Wrap r.Body with http.MaxBytesReader before you decode it. Go's MaxHeaderBytes limits headers only, so request bodies have no default size cap.
Oct 19, 20264 min read
Security Guides
Which timeouts should a Go HTTP server set?
Which timeouts does a Go net/http server need? Set ReadHeaderTimeout, IdleTimeout and a write limit, because ListenAndServe applies none by default.
Oct 19, 20264 min read
Security Guides
Does Go's http.Client have a timeout by default?
No. Go's http.Client Timeout of zero means no timeout, and DefaultClient uses it. Here is how to set client, request and context deadlines safely.
Oct 19, 20264 min read
Security Guides
What happens when a Go HTTP handler panics?
Go's net/http server recovers a handler panic, logs a stack trace and drops the connection. Add your own recovery middleware to control the response.
Oct 19, 20264 min read
Security Guides
Go in Docker: FROM scratch or distroless static, and what must you add?
A static Go binary runs on scratch, but you must add certificates, time zones and a user yourself. Distroless static ships them. Compare the two.
Oct 19, 20264 min read
Security Guides
A Go binary in my image has a standard library finding: how to fix it
Go compiles the standard library into your binary, so the fix is a rebuild with a patched Go toolchain, not an OS update. Steps to confirm and verify.
Oct 19, 20264 min read
Security Guides
Why did my scan flag a Go vulnerability that only affects another OS?
Go advisories can name the operating system and architecture where the flaw appears. Version-only matching ignores that, so findings can look wrong.
Oct 19, 20264 min read
Security Guides
How do you limit cloud access to protected branches with GitLab OIDC?
GitLab ID tokens carry a ref_protected claim. Use it, plus project_id and namespace_id, in your cloud trust rule so only protected refs can deploy.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.