Security Guides
Does a package with zero CVEs mean it is safe to use?
Zero CVEs means no published flaw, not a clean bill of health. Why the count misleads in both directions, and what to check alongside it.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Does wp plugin verify-checksums prove a plugin is safe?
wp plugin verify-checksums shows whether plugin files match WordPress.org copies. It finds tampering, not vulnerabilities, and skips non-directory plugins.
Oct 19, 20263 min read
Security Guides
Does Voila hide your notebook code when you share a dashboard?
Voila hides code cells by default, but it still runs the notebook on a live kernel for each visitor. Hidden code is not the same as a safe app.
Oct 19, 20263 min read
Security Guides
Does the strangler facade need its own security controls?
Yes. The facade in a strangler migration sees every request to old and new code. Here are the controls to put on it and the mistakes to avoid.
Oct 19, 20264 min read
Security Guides
Does the Apache Spark web UI have built-in authentication?
Spark says it provides no built-in authentication filters for its web UI. Add a servlet filter, set ACLs, and keep the UI off public networks.
Oct 19, 20263 min read
Security Guides
Does the scanner demo show direct and transitive dependencies?
A scanner demo should show both direct and transitive dependencies and the path between them. Here is how to test it on your repo in about five minutes.
Oct 19, 20264 min read
Security Guides
Does the library have a security policy, and what should it say?
Before adopting a library, check for a SECURITY.md. What a useful policy contains, what a missing one tells you, and how to ask maintainers politely.
Oct 19, 20263 min read
Security Guides
Does the hash PyPI shows protect you from a tampered package?
The sha256 in a PyPI download link guards against corruption, not tampering. Here is why pip does not count it as a local hash and what to do instead.
Oct 19, 20264 min read
Security Guides
How do you check that a scanner's fix pull request builds?
A scanner demo may promise automatic fixes. Check that the fix pull request builds, passes your tests, and changes only what it should before you believe it.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.