Security Guides
Should a deploy gate block, warn or ask for approval?
Pick the right deploy gate outcome by severity, reversibility and noise. A decision table for block, warn and approve, plus how to promote each rule.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Dependency updates FAQ for engineering managers: nine plain answers
Nine short answers for engineering managers about dependency updates: how often, how much time, what to automate, what to skip and what the risk is.
Oct 19, 20263 min read
Security Guides
A 10 question dependency security quiz for new engineers
Ten questions with answers that check whether a new engineer understands lockfiles, ranges, install scripts, audits and approvals. Use it in week one.
Oct 19, 20263 min read
Security Guides
How do you run a dependency scanning proof of concept in two weeks?
Run a dependency scanning proof of concept in ten working days: pick repos, set pass marks first, test, then decide. A day by day plan with success criteria.
Oct 19, 20264 min read
Security Guides
Can you run a dependency scanning PoC with an open source scanner?
Yes. The plan is the same, but you own setup, data feeds and upkeep. What changes in a PoC of a self run open source scanner, and what to measure.
Oct 19, 20264 min read
Security Guides
What success criteria should a dependency scanning PoC have?
Seven measurable pass marks for a dependency scanning proof of concept, with how to measure each and what a fail looks like. Write them before the trial.
Oct 19, 20264 min read
Security Guides
Do your reviewers agree? A reviewer agreement check for scanner PoCs
Have two people label the same 20 scanner findings, then compare. Low agreement means your accuracy number is unreliable. A simple method for PoCs.
Oct 19, 20264 min read
Security Guides
How do you keep a dependency scanning PoC from touching production?
Keep a scanner trial safe: read only access, throwaway branches, no auto merge, scoped tokens and a revoke date. A checklist for a PoC that cannot hurt prod.
Oct 19, 20264 min read
Security Guides
What goes in a one page dependency scanning PoC charter?
A one page charter keeps a dependency scanning PoC honest: goal, scope, people, pass marks, data rules, dates and exit. A fill in outline you can copy.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.