Security Guides
Does Rails API mode need CSRF protection?
Token APIs without cookies usually skip CSRF tokens, but cookie sessions change that. How to decide for a Rails API and what a scan checks.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Does protobuf type safety mean you can skip input validation?
No. Protobuf checks field types, not business rules. See what it does not validate, how to add field rules, and why message size still needs limits.
Oct 19, 20264 min read
Security Guides
Does patching the OS fix vulnerable application dependencies?
No. OS updates replace packages in the system repository. Libraries in node_modules, virtual environments and jars need their own update. Here is why.
Oct 19, 20263 min read
Security Guides
Does pandas read_sql protect you from SQL injection?
pandas read_sql does not sanitize SQL, it forwards your string to the driver. Use the params argument, not f-strings, and know your driver's paramstyle.
Oct 19, 20264 min read
Security Guides
Does one security.txt cover all your subdomains? What RFC 9116 says
No. RFC 9116 scopes a security.txt file to the exact host that served it. Where to publish it, the content type to use and a curl check for each host.
Oct 19, 20264 min read
Security Guides
Does OIDC remove every secret from your CI pipeline?
OIDC replaces stored cloud keys, not every credential. Third party API keys, signing keys, and registry tokens often remain. How to find what is left.
Oct 19, 20264 min read
Security Guides
Does a new admission policy affect pods that are already running?
A new Kubernetes admission policy checks create and update requests, so running pods are not evicted. Learn what it does touch and how to audit the rest.
Oct 19, 20264 min read
Security Guides
How do you check whether your fork contains an upstream security fix?
Find the fix commit upstream, then use git ancestry checks and patch equivalence to see whether your fork has it, even if it was cherry-picked.
Oct 19, 20264 min read
Security Guides
Does multi-factor authentication stop a software supply chain attack?
MFA protects accounts, not the software you install. It helps against some supply chain attacks, such as stolen publisher logins, but not all of them.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.