Security Guides
Should you limit low-code connectors to an approved list?
Yes for most organizations: an approved connector list limits where data can flow. How to build one, handle exceptions and restrict custom connectors.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Is an approved open source package approved for every use?
No. An approval covers the use that was reviewed. How to record the purpose of each package, and when a new use should trigger a fresh review.
Oct 19, 20263 min read
Security Guides
Do you approve a package, a version or a version range?
Approving a package name is not the same as approving every version. How regulated teams scope approvals to versions or ranges and keep the record clear.
Oct 19, 20263 min read
Security Guides
API security misconfiguration checklist for Spring, FastAPI, NestJS, Rails
OWASP API8 prevention turned into framework checks: docs, CORS, methods, error output and TLS, with a table for Spring, FastAPI, NestJS and Rails.
Oct 19, 20264 min read
Security Guides
What does the Apache 2.0 patent clause do, and when does it end?
Apache 2.0 gives users a patent license from each contributor. It ends for you if you sue claiming the Work infringes a patent. Plain language and steps.
Oct 19, 20264 min read
Security Guides
What do you say when asked for a patching SLA and you have none?
A customer asks for your patching timelines and you have never written them down. How to set targets, answer truthfully and keep the evidence to back them.
Oct 19, 20264 min read
Security Guides
How do you run an annual security review for a 15 person team?
Once a year, step back: review the threats, the controls, the documents and last year's actions. Seven questions and a half day format for small teams.
Oct 19, 20264 min read
Security Guides
When should you revisit your open source vs managed scanner decision?
Review the open source versus managed choice yearly and after seven triggers, from team growth to audit pressure. A checklist for a one hour review.
Oct 19, 20263 min read
Security Guides
How often should you review your open source scanner stack?
Review open source scanners once a year and after any trigger event. A checklist covers health, coverage, data freshness, permissions and exit signals.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.