Security Guides
Which files in a repository should a security scan cover?
A good repository scan reads lockfiles, source, Dockerfiles, IaC, CI workflows and config. A file-by-file table of what to scan and what each reveals.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
You have 40 end-of-life components. Which do you fix first?
A scoring method to rank end-of-life components by exposure, data sensitivity, exploit signals and upgrade effort, so the first fixes cut the most risk.
Oct 18, 20264 min read
Security Guides
Which credentials should you rotate after a zero-day exploit?
After a zero-day on a server, rotate what that server could read: service accounts, API keys, certificates, tokens and config secrets. A prioritised list.
Oct 18, 20263 min read
Security Guides
In what order should you adopt AppSec tools as you grow?
A practical order for adopting AppSec tools by company stage: secrets, dependencies, static analysis, containers, dynamic testing, then wider coverage.
Oct 18, 20263 min read
Security Guides
Which AppSec test belongs at which stage of the pipeline?
Run fast checks at commit and pull request, heavier ones at build and staging, and monitoring after release. A stage by stage table for SAST, SCA and DAST.
Oct 18, 20263 min read
Security Guides
Where to store keys on a device: TEE, secure element or flash?
ETSI EN 303 645 requires sensitive security parameters in persistent storage to be stored securely. Options named include TEEs and secure elements.
Oct 18, 20263 min read
Security Guides
Where should you scan for secrets besides your git repositories?
Secrets also leak through issues, pull requests, wikis, CI logs, container images and build artifacts. A table of places to scan and who owns each.
Oct 18, 20263 min read
Security Guides
Where should you get alerts about new zero-days?
Sources for zero-day alerts: vendor advisories, the CISA KEV catalog, open source advisory databases and your own dependency data. What each is good for.
Oct 18, 20263 min read
Security Guides
Where should vulnerability exceptions live: scanner, ticket or GRC?
Keep the exception where the finding lives so gates can enforce it, and link it to tickets and your risk register. A decision guide for three options.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.