Security Guides
Is an SBOM format an official standard? ECMA-424 and ISO 5962
Both major SBOM formats are formal standards: CycloneDX as ECMA-424 and SPDX as ISO/IEC 5962:2021. What that means and what it does not promise.
Oct 19, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Which date in an incident write-up matters for your scoping?
An incident write-up mixes publish, removal, disclosure, advisory and edit dates. Learn which one scopes your exposure and where to find each timestamp.
Oct 19, 20266 min read
Security Guides
Can you run IAST in production, and should you?
OWASP lists production as a place IAST feedback can happen, but that is a risk decision, not a default. How to weigh data exposure, overhead and rollback.
Oct 19, 20266 min read
Security Guides
How do you test whether a normal user can call admin API functions?
List admin and role-limited operations, call them as a lower role with every HTTP method, and judge the status codes. A five-step function access test.
Oct 19, 20267 min read
Security Guides
Security tool RFP myths vs facts: what really improves the outcome
Seven myths about security tool RFPs, from longer is better to the demo decides, with the facts and what to do instead. A quick reference for buyers.
Oct 19, 20266 min read
Security Guides
How do you rank 500 vulnerabilities with four simple questions?
Facing hundreds of scan findings? Four plain questions on exploitation, reach, exposure and importance sort the list so you fix the right items first.
Oct 19, 20268 min read
Security Guides
What Is a Fix Pull Request and How Does It Work?
A fix pull request is a proposed code change that repairs a security problem and waits for a person to approve it. Here is how one works, step by step.
Oct 19, 202610 min read
Security Guides
Why does IAST find nothing when your test coverage is thin?
IAST only reports on code that actually runs. A clean report from a thin test suite is not proof of safety. Here is how to check what was exercised.
Oct 19, 20266 min read
Security Guides
How should you run the vendor question period in a security RFP?
Collect questions in writing, answer every vendor with the same text, set a closing date, and log changes. A fair Q and A process for security tool RFPs.
Oct 19, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.