Security Guides
What is a DAST scan policy and how do you tune one?
A DAST scan policy decides which attack rules run and how hard they push. See what strength and threshold change and how to tune them safely.
Oct 19, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
API security testing terms explained: twelve you will hear in vendor calls
Plain definitions of BOLA, BFLA, BOPLA, introspection, fuzzing, baseline and active scans, spec import and shadow APIs, so you can follow a vendor call.
Oct 19, 20269 min read
Security Guides
Can you run SAST on code a contractor delivers, and what to do with it?
Yes, if the contract and access allow it. Set scan expectations before delivery, scan on acceptance, and agree how findings flow back to the contractor.
Oct 19, 20267 min read
Security Guides
Which metrics show vulnerability management, SCA and ASPM are working?
Pick two or three metrics per layer: coverage and freshness for SCA, dedupe and routing for ASPM, age and time to fix for the vulnerability process.
Oct 19, 20266 min read
Security Guides
Shallow vs deep health checks: when a check makes an outage worse
Deep health checks that test shared dependencies can pull every server out of rotation at once. Learn the four check types and how to set them safely.
Oct 19, 20267 min read
Security Guides
What should you test in a trial of an API security scanner?
Ten pass or fail tests for an API scanner trial: spec import, login, two-user object checks, role checks, batching, noise, safe mode, CI exit and evidence.
Oct 19, 20268 min read
Security Guides
Why can a Debian image scan clean for a package with no security support?
Debian marks some packages end-of-life or removed in a release. A scan can then show nothing because no one is tracking fixes. Here is how to spot it.
Oct 19, 20266 min read
Security Guides
How do I know if a supply chain attack affects my software?
When a supply chain attack hits the news, here is a simple way to check if it hit you: the package, the version, where it ran and what it could reach.
Oct 19, 20267 min read
Security Guides
How do you read a vendor's incident report for your own plan?
A public incident report is free planning material. Learn five questions to ask of any report and turn the answers into changes in your own runbooks.
Oct 19, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.