Security Guides
Fork pull request security: five myths and what is actually true
Five common beliefs about fork pull requests, secrets and workflows, checked against GitHub's documentation, with what to do about each of them.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you forecast when your vulnerability backlog will clear?
Forecast a backlog clear date by dividing open items by net closure rate, then show a range. Includes a worked example and the checks that keep it honest.
Oct 19, 20264 min read
Security Guides
Force-installed or normal-installed: which extension mode should you use?
Both modes install an extension automatically. Only force-installed stops users removing it. Here is a simple rule for choosing between them.
Oct 19, 20264 min read
Security Guides
Force-installed or normal-installed extension: which mode fits?
Force install pins a required extension that users cannot remove. Normal install lets them disable it. How to choose, and what each needs to work.
Oct 19, 20263 min read
Security Guides
Which Flask session cookie settings should you set for production?
Set SESSION_COOKIE_SECURE to True and SESSION_COOKIE_SAMESITE to Lax, keep HTTPONLY on, and leave the cookie domain unset. Defaults and what each blocks.
Oct 19, 20264 min read
Security Guides
Which Flask request limits stop oversized uploads and form floods?
MAX_CONTENT_LENGTH is unset by default, so set it. MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS have defaults. How Flask limits combine and where else to cap.
Oct 19, 20264 min read
Security Guides
Is secure_filename enough to make Flask file uploads safe?
secure_filename blocks path traversal in filenames, but not content, size, type or how files are served. A fuller Flask upload checklist to follow.
Oct 19, 20264 min read
Security Guides
Why was a Go security issue fixed in public with no warning?
Go sorts security issues into PUBLIC, PRIVATE and URGENT tracks. Only PRIVATE gets a pre-announcement. Here is what each means for your upgrade plan.
Oct 19, 20264 min read
Security Guides
How do you show vulnerability fix times with real ticket data?
Pull opened and closed dates from your tracker for serious findings, report the real spread and explain outliers. Buyers trust measured times over targets.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.