Security Guides
AI suggested path traversal fix: what should you check?
Path traversal fixes that only strip dot-dot-slash often fail. Check how an AI fix handles absolute paths, encodings and the final resolved location.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
AI suggested password hashing fix: what should you verify?
If an AI replaces MD5 or SHA with something else for passwords, verify the algorithm, salt, work factor and migration of old hashes before you merge.
Oct 19, 20264 min read
Security Guides
AI suggested config or IaC fix: how do you spot widened access?
AI fixes to infrastructure code can make an error disappear by granting broader permissions. Check permission, network and secret changes line by line.
Oct 19, 20264 min read
Security Guides
A scorecard for rating AI remediation suggestions in seven criteria
Score any AI suggested fix from 0 to 2 on seven criteria, from root cause to rollback, then use the total to decide whether to merge, rework or reject it.
Oct 19, 20264 min read
Security Guides
AI security tool evaluation FAQ: ten quick answers for engineering leaders
Ten short answers on evaluating security tooling for teams that build with models, agents and MCP: scope, tests, evidence, gaps and how long to take.
Oct 19, 20263 min read
Security Guides
How do you roll out an AI coding agent in rings with gates?
Roll out a coding agent in four rings, from a security pilot to broad use, with a written gate between each ring. Here is a plan you can adapt.
Oct 19, 20263 min read
Security Guides
What go or no-go criteria should an AI coding agent pilot use?
Decide go or no go on a coding agent pilot with criteria set in advance: control coverage, review quality, incident count and developer feedback.
Oct 19, 20263 min read
Security Guides
What permissions should an AI coding agent get on a dev laptop?
A coding agent should start read only on a laptop, with write limited to the project and no production credentials. Here is a permission matrix to adapt.
Oct 19, 20264 min read
Security Guides
What is an AI agent sponsor and what are they accountable for?
An AI agent sponsor is the named human accountable for an agent's purpose, access and retirement. Duties, a sample charter, and what happens if they leave.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.