Security Guides
Should fix PRs merge during a release freeze or holiday?
Decide in advance what happens to automated fix PRs during release freezes, holidays and on-call gaps: hold, allow by severity, or pause entirely.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Fix, mitigate or accept? How SSDF RV.2.2 risk responses are recorded
SSDF RV.2.2 asks for a risk-based plan for each vulnerability: remediate, mitigate temporarily, or accept. How to record the decision so it holds up.
Oct 19, 20264 min read
Security Guides
The fix is in a newer OS release: what do you do?
When a scan shows a fix is available in a newer OS release, choose between a base image move, a backport check or a dated exception. A decision path.
Oct 19, 20264 min read
Security Guides
Why fix base image findings before application findings?
Base layers sit under everything and are shared by many services, so one base fix clears more findings than any app change. Here is the order and why.
Oct 19, 20264 min read
Security Guides
What is a fix available but not applied metric, and why does it matter?
Findings with a vendor fix you have not applied are the cheapest risk to remove. How to measure that backlog, set a target, and explain it to leaders.
Oct 19, 20264 min read
Security Guides
Are the five whys enough for a security postmortem?
The five whys is a quick way to walk a causal chain, but security incidents usually have several causes. How to use it without stopping too early.
Oct 19, 20264 min read
Security Guides
When does a change need a security design review? Five triggers
Not every change needs a design review. Five triggers tell you when one is worth the time, and a quick path for the rest. Includes a decision table.
Oct 19, 20264 min read
Security Guides
How to write a five sentence executive summary for a postmortem
Five sentences cover what happened, who was affected, what you did, why it happened and what changes. A template for supply chain postmortem summaries.
Oct 19, 20263 min read
Security Guides
What five questions threat model a plugin system before launch?
A lightweight threat model for a plugin platform: who writes plugins, what they reach, how they update, how you stop one and how you know. Five questions.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.