Security Guides
Do I need ASPM if I already have SCA? A decision guide
If SCA is your only scanner and one team reads the results, you probably do not need ASPM yet. Here are the signals that say it is time to add one.
Oct 19, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you security-test a GraphQL API? Six checks in order
Start with introspection, then field suggestions, batching, query cost, authorization and injection. A short order of work for testing a GraphQL API.
Oct 19, 20267 min read
Security Guides
How do you build a security tool long list without an analyst report?
Collect candidates from peers, open standards, marketplaces, your developers and public docs, then filter with deal breakers. Five sources and a log.
Oct 19, 20266 min read
Security Guides
Why does an authenticated API scan quietly become an anonymous one?
Expired tokens, nonces and signed requests can log a scanner out mid-run, so everything returns 401 and looks secure. How to detect and prevent it.
Oct 19, 20267 min read
Security Guides
ASPM or a spreadsheet: when is a shared sheet enough?
A shared sheet can do the job of ASPM for a small estate. Here are the columns to track and the thresholds that signal it is time to automate.
Oct 19, 20266 min read
Security Guides
Should I fix this vulnerability alert? A five question check
A plain five question check to decide if a vulnerability alert needs a fix now, soon, or a recorded no, using exploitation, reach and impact.
Oct 19, 202610 min read
Security Guides
Why do most vulnerability alerts need no action? Five reasons
Most vulnerability alerts need no fix because the flaw cannot touch your software as it runs. Five common reasons, how to check each, and what to record.
Oct 19, 202611 min read
Security Guides
What should you record after an API security test?
A test is only reusable if you can say what was tested, as whom, when and what happened. Twelve fields to record after every API security test.
Oct 19, 20268 min read
Security Guides
Can DAST find blind vulnerabilities? Out-of-band testing explained
Can DAST find blind bugs that show nothing in the response? Yes, with out-of-band testing, where the app calls back to a listener. Limits included.
Oct 19, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.