Security Guides
Can you hide an API key inside a mobile app?
No. Any key shipped in an app can be pulled out by the person who installs it. Here is what to do instead: a backend proxy, scoped tokens and rotation.
Oct 19, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Can you convert a zip Lambda function to a container image?
AWS does not let you change the package type of an existing Lambda function. Moving from zip to container means a new function. A safe migration plan.
Oct 19, 20264 min read
Security Guides
Can you charge money for software that includes GPL code?
Yes. The GPL lets you sell copies and charge download fees. Here is what you still owe buyers: source code, a written offer, and the same license terms.
Oct 19, 20264 min read
Security Guides
Can you block themes and other add-on types by policy?
Chrome and Firefox let you limit installable add-on types with allowed_types. The types, where it applies and the exceptions that catch teams.
Oct 19, 20263 min read
Security Guides
Can you average CVSS scores across findings and trend them?
Averaging CVSS scores gives a number with no clear meaning. See why severity is not risk, and what to chart on a dashboard instead of a mean score.
Oct 19, 20264 min read
Security Guides
Is a costly major version upgrade a valid reason for an exception?
A costly major upgrade can justify a time-boxed exception only if the work is planned, exposure is limited and reviews are frequent. Here is how.
Oct 19, 20264 min read
Security Guides
Can a security vendor's support staff see your code and findings?
Support access is where data handling promises get tested. Ask who can open your tenant, how it is approved, logged and timed, and what you can see.
Oct 19, 20264 min read
Security Guides
Can users tamper with a force-installed browser extension?
Chrome calls its protection of force-installed extensions best effort, and notes developer tools can alter extension source. Here are the limits and fixes.
Oct 19, 20264 min read
Security Guides
Can user-controlled styles be dangerous in Vue? Style injection
Letting users supply CSS can enable clickjacking and page takeover of the visuals. See how Vue treats style tags and how to allow safe style choices.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.