Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A customer's day one checklist when a software vendor reports a compromise: scope, contain, rotate, hunt, ask the vendor and document it all as you go.
Lock the account, revoke tokens, tell the registry, publish a clean version and warn users. A first 24 hour plan for package maintainers who were hit.
Check that XML parsers reject DTDs or disable external entities, per language: Java factories, .NET resolvers, Python defusedxml and PHP libxml flags.
A fix for a vulnerability should arrive with a test that fails before the change and passes after. Here is the pull request checklist to enforce it.
Security OKRs fail when key results count activity. Write them around exposure, speed and coverage, with examples an engineering manager can adapt.
Before vendor calls, write one page: languages, build, CI, data rules, triage owners and must haves. It keeps static analysis demos honest and comparable.
Lead with method, show raw numbers, state conflicts and limits, and keep the decision apart from the data. A report outline for security tool evaluations.
A good SAST suppression names the rule, says why the code is safe, points to evidence, and carries an owner and a review date. Here is a template.
A champions charter fits on one page: purpose, roles, time, decisions, training, recognition and review. Copy the template and adapt it to your team.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
