Security Guides
Passive or active DAST scan: which one do you need?
Passive DAST watches traffic and sends no attacks, active DAST sends crafted requests. Compare safety, findings and where each belongs in your pipeline.
Oct 19, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do I find every app that uses a vulnerable library?
When a popular library has a serious flaw, you need to know which apps use it. A plain method, from searching by hand to a standing inventory.
Oct 19, 20268 min read
Security Guides
Should I upgrade a vulnerable package to the latest version?
Not always. Learn when to take the smallest safe upgrade, when the latest version is worth it, and how patch, minor and major numbers predict the risk.
Oct 19, 20268 min read
Security Guides
What is a CBOM, and how is it different from an SBOM?
A CBOM inventories cryptographic assets such as algorithms, keys and certificates. Learn how it differs from an SBOM and when your team needs one.
Oct 19, 20266 min read
Security Guides
Do you need a second DNS provider? What RFC 2182 says
RFC 2182 explains why DNS zones need geographically and topologically diverse secondary servers. Here is how to apply that to a single provider setup.
Oct 19, 20267 min read
Security Guides
What is the Juliet test suite and what does it say about a SAST tool?
Juliet is a public NIST collection of C and C++ test cases grouped by weakness type. It helps test SAST tools, but it is not a score for your code.
Oct 19, 20267 min read
Security Guides
Who owns what: vulnerability management, SCA and ASPM in your org
A practical ownership map for vulnerability management, SCA and ASPM: what security, AppSec and engineering each decide, run and fix, and the handoffs.
Oct 19, 20266 min read
Security Guides
How do you roll back a harmful change an AI coding agent made?
Stop the agent, revoke its access, preserve logs, revert the change, and rotate anything it touched. A seven step runbook for harmful agent changes.
Oct 19, 20267 min read
Security Guides
Can a small team run a security tool RFP on one page?
Yes. A one page RFP with a problem statement, five musts, four questions and a two week test fits a small team. Template and what to skip inside.
Oct 19, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.