Security Guides
Why do fixed vulnerabilities keep coming back in my scans?
A finding you fixed shows up again. This guide explains the seven usual causes, how to tell which one you have, and how to make a fix stay fixed.
Oct 19, 20269 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Which image labels help route container findings to an owner?
Five standard OCI image annotations, such as source and authors, let a scan finding find its owner without a spreadsheet. Here is how to set them.
Oct 19, 20266 min read
Security Guides
What data does a container scanner send out of your network?
Before you approve a container scanner, ask what leaves your network: image contents, package lists, metadata or only hashes. Here is a checklist.
Oct 19, 20266 min read
Security Guides
Does SAST cover the CWE Top 25 weaknesses?
SAST fits some CWE Top 25 entries well, such as injection, and others poorly, such as missing authorization. A weakness by weakness view for buyers.
Oct 19, 20267 min read
Security Guides
How does a scanner know an Alpine package is vulnerable?
Alpine publishes a per-release list of fixed CVEs by package. Here is what that data shows, what it leaves out, and how scanners use it to flag images.
Oct 19, 20267 min read
Security Guides
IAST and RASP glossary: what do sensor, agent and virtual patch mean?
Plain definitions of the words in IAST and RASP sales calls: sensor, agent, instrumentation, virtual patch, WAF, coverage, monitor mode and fail open.
Oct 19, 20266 min read
Security Guides
What knockout questions belong at the top of a security tool RFP?
Knockout questions are yes or no gates that save everyone time. Here are ten for security tooling, how to word them, and when to waive one of them.
Oct 19, 20267 min read
Security Guides
How do you split must-have from nice-to-have security requirements?
Sort requirements into must, should and could using three tests: what breaks without it, who is affected, and whether you can verify it. A worked example.
Oct 19, 20266 min read
Security Guides
How do you test whether an API returns more data than the UI shows?
Capture the API response behind a page, diff it against what the screen shows, and repeat as other roles. A nine-step test for excessive data exposure.
Oct 19, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.