Security Guides
Do low-code sub-workflows inherit the parent app's security?
Not necessarily. Nested sub-workflows can lack the parent's controls and leak data. How to document inputs and outputs and keep controls consistent.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Do static sites need vulnerability scanning?
Yes. A static site has no server to patch, but its build tools, npm packages, scripts and embeds still carry known vulnerabilities. Here is what to scan.
Oct 19, 20264 min read
Security Guides
Do your staging services call real third-party APIs? How to check
Check whether staging and test environments use production vendor accounts, then move them to sandboxes and record the environment in your inventory.
Oct 19, 20264 min read
Security Guides
Do secrets in old repo history follow you into the monorepo?
Yes: importing history imports any secret that was ever committed. Scan before the merge, rotate what you find, and rewrite only if rotation is not enough.
Oct 19, 20263 min read
Security Guides
Do RPA bots need their own identity, or can they share a login?
Give every RPA bot its own account. Shared logins hide who did what, widen blast radius and make offboarding harder. Here is how to split them sensibly.
Oct 19, 20264 min read
Security Guides
Do Redis key patterns isolate tenants? The FLUSHALL gap
Redis ACL key patterns limit commands that name keys, but a user limited to tenant1 keys can still run FLUSHALL. How to isolate tenants properly.
Oct 19, 20264 min read
Security Guides
Do pinned dependencies leave you running old, vulnerable versions?
Pinning stops surprise updates but also stops fixes. Pair pins with scheduled updates, scanning and a fast path for urgent patches to avoid going stale.
Oct 19, 20264 min read
Security Guides
Is it safe to install packages at Lambda cold start?
Installing packages into /tmp at cold start dodges size limits but adds latency and unreviewed code. Safer options for large dependencies are below.
Oct 19, 20264 min read
Security Guides
Do nginx access logs record secrets in query strings?
The default nginx combined log format records the full request line, query string included, plus the Referer. Learn what that exposes and how to log less.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.