Security Guides
Does a signed container image mean it was scanned?
No. A signature says who published an image and that it was not altered. It says nothing about vulnerabilities. Here is how to ask for both proofs.
Oct 19, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you score container image scanners fairly?
A weighted scorecard for container image scanning trials: coverage, accuracy, fix guidance, workflow fit and evidence, with pass criteria you can test.
Oct 19, 20266 min read
Security Guides
Can RASP stop API attacks, and what can it not see?
RASP can watch how an app handles API input and block injection style attacks. Business logic abuse is harder. What to expect and what to cover elsewhere.
Oct 19, 20266 min read
Security Guides
How do you rank DAST findings to decide what gets fixed first?
How to rank DAST findings: confirm each, then weigh exposure, data, access needed and fix effort. A scoring table, a worked example and a weekly routine.
Oct 19, 20266 min read
Security Guides
How long will a restore really take? How to measure it
Backups help when restore time fits your recovery target. Run a timed restore, record each stage, and find the slow step before you need it.
Oct 19, 20267 min read
Security Guides
Why does my small app have hundreds of dependencies?
A short app can pull in hundreds of packages because each package needs others. Learn how the tree grows, why it matters for security, and how to see it.
Oct 19, 20269 min read
Security Guides
Do download counts in a headline show how many installs are affected?
A package's download total is not the number of affected installs. See what npm download counts include, how they are timed and what to measure instead.
Oct 19, 20266 min read
Security Guides
Where should vulnerability findings live: scanner, ASPM or tracker?
Keep detection data in the scanner, the ranked view in ASPM or a sheet, and the work in the team's own ticket tracker. Here is the reasoning.
Oct 19, 20266 min read
Security Guides
How do you find and test hidden API parameters?
Hidden parameters appear in traffic, client code and older specs. Capture requests across roles, probe with invalid values and watch how responses differ.
Oct 19, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.