Security Guides
What are a source and a sink in static analysis?
A source is where untrusted data enters code, a sink is where it becomes dangerous. SAST tools trace paths between them. Learn how to read a finding.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What is a software supply chain incident response plan?
A supply chain plan adds package, build and artifact steps to your normal incident plan. Here is a definition and the sections it should include.
Oct 18, 20263 min read
Security Guides
What is a PSIRT, and does a small product team need one?
A PSIRT handles vulnerabilities in the products you make. Small teams need the functions, not a department. What FIRST's services framework covers.
Oct 18, 20263 min read
Security Guides
What is a false positive in vulnerability scanning?
A false positive is an alert that does not apply to you. Why scanners raise them, what they cost a team, and how managers can reduce the noise.
Oct 18, 20263 min read
Security Guides
What do hostNetwork, hostPID and hostIPC do in a pod spec?
These three fields put a pod in the node's network, process and IPC namespaces. The Baseline standard forbids them. Here is what each exposes.
Oct 18, 20263 min read
Security Guides
What should happen when a vulnerability exception expires?
At expiry, the finding should become active again, the owner is told, and renewal needs a fresh decision. A simple expiry and renewal flow.
Oct 18, 20263 min read
Security Guides
What happens when an AWS Lambda runtime is deprecated?
Deprecation does not switch your function off. Patches may stop, support ends, and creating or updating functions is blocked in stages. The timeline.
Oct 18, 20264 min read
Security Guides
What happens to custom resources when you delete a CRD?
Deleting a CRD removes its API and every custom object stored under it, in all namespaces. Learn what to export, check and restrict before you remove one.
Oct 18, 20264 min read
Security Guides
What does gVisor not protect against?
gVisor blocks workloads from the host kernel but not from attacks on the runtime stack, CPU side channels, or the data inside the sandbox. Know the gaps.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.