Security Guides
Why do SAST findings show CWE ids instead of CVE ids?
A CWE names a type of weakness, a CVE names a specific vulnerability in a specific product. SAST finds weaknesses in your code, so it reports CWE ids.
Oct 19, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Does squashing a Docker image hide vulnerabilities from scanners?
Squashing merges layers but not packages, so a scanner still sees installed software. What you lose is layer history, which helps you trace the fix.
Oct 19, 20266 min read
Security Guides
First hour after a platform flags a critical dependency flaw
A runbook for the first hour after your platform flags a critical dependency flaw: confirm, scope, rank by exploitation, pick a fix path, and communicate.
Oct 19, 20266 min read
Security Guides
What registry permissions does a container scanner need?
A registry scanner needs to list repositories and pull images, nothing more. Here is how to give it read-only access, with Amazon ECR as the example.
Oct 19, 20267 min read
Security Guides
Does an SCA tool need write access to your repositories?
Scanning needs read access only. Write access is needed only for features that open fix pull requests. Here is how to scope permissions and test them.
Oct 19, 20266 min read
Security Guides
What do caret and tilde mean in a package version range?
The little `^` and `~` signs before a version decide which updates your app accepts. Learn how they work and how they change your security exposure.
Oct 19, 20269 min read
Security Guides
What should an SCA vendor commit to in writing about monitoring?
'Continuous monitoring' is vague. Ask an SCA vendor to define rescan triggers, alert timing, and notification paths in writing before you sign.
Oct 19, 20266 min read
Security Guides
How do you run SAST on a codebase you just acquired?
Scan an acquired codebase in a way that tells you what you own: inventory, one baseline scan, triage by weakness type, and a short risk note. A week plan.
Oct 19, 20267 min read
Security Guides
What happens when a RASP agent fails: fail open or fail closed?
A RASP agent that cannot load either lets traffic through unprotected or stops the app. Learn how to find out which your product does before an incident.
Oct 19, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.