Security Guides
What does strict-dynamic do in a Content Security Policy?
strict-dynamic passes trust from a nonced or hashed script to the scripts it loads. See when it helps, what it weakens, and a safe starting policy.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Which small CSP directives matter: base-uri, object-src, form-action?
Three short CSP directives close gaps that script-src leaves open: base-uri, object-src and form-action. See what each blocks and which skip default-src.
Oct 19, 20264 min read
Security Guides
What should you check in a code review that touches cryptography?
Ten questions reviewers can ask when a pull request adds encryption, hashing or key handling. Based on OWASP and CWE guidance, with a table of red flags.
Oct 19, 20264 min read
Security Guides
What is Cross-Origin-Resource-Policy, and how is it not CORS?
CORP stops other origins reading your no-cors resources, while CORS opens up reads. Learn the three CORP values, what it blocks, and one Chrome PDF caveat.
Oct 19, 20263 min read
Security Guides
A critical CVE lands in launch week: what do you decide?
When a critical CVE hits in launch week, decide in this order: are we affected, is it exploited, is a fix available, and can we ship with a mitigation.
Oct 19, 20263 min read
Security Guides
What if a critical CVE lands in the middle of a buyer's review?
A major vulnerability is announced while a deal is in security review. How a startup should check exposure, tell the buyer first, and turn it into trust.
Oct 19, 20264 min read
Security Guides
How often should a small team rotate API keys and credentials?
Rotate by risk: powerful, long lived credentials most often, plus on every departure or leak. A simple rotation calendar for small teams to keep.
Oct 19, 20263 min read
Security Guides
How do you count vulnerabilities in containers that live for hours?
Count findings per image and per service, not per running container. How to avoid double counting and measure exposure time for short lived workloads.
Oct 19, 20263 min read
Security Guides
Copied a CI workflow from a blog or forum? How to review it first
A workflow pasted from a blog post or forum answer runs with your token and secrets. Six review steps to take before it ever runs on your repository.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.