Security Guides
What does a security champion do in a typical week?
A security champion spends protected weekly time on defect triage, reviews, a briefing and helping teammates. A sample week and what to avoid assigning.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What does a container image scan actually check?
An image scan inventories packages in the layers and matches them to known vulnerabilities. It does not test running behavior. What it covers, misses.
Oct 18, 20263 min read
Security Guides
What do Google restricted scopes mean for apps you connect?
Restricted scopes give an app wide access to Google user data and trigger extra review. What that means when you approve an app for your company.
Oct 18, 20263 min read
Security Guides
What data should never go into an AI coding assistant?
Credentials, customer data, regulated records and private keys should stay out of AI coding assistants. A simple four-level data rule to apply.
Oct 18, 20263 min read
Security Guides
What CVSS severity should fail a CI build?
Start by failing builds on High and Critical, then tighten. How CVSS bands map to a CI threshold, and why a score alone is a weak gate on its own.
Oct 18, 20264 min read
Security Guides
What can you learn about a vendor's security without asking them?
Public signals tell you a lot before a questionnaire goes out: security pages, advisories, exploited vulnerability listings and terms. A short guide.
Oct 18, 20264 min read
Security Guides
What can a third-party script do on your web page?
A third-party script runs as code in your visitors' browsers. See the three risks OWASP names and the controls that limit what a script can reach.
Oct 18, 20263 min read
Security Guides
What can a dbt macro or hook do in your warehouse?
dbt macros, hooks and run-operation execute SQL through your connection. Here is what that means for privileges and for reviewing code you did not write.
Oct 18, 20263 min read
Security Guides
What breaks when DIY scanning grows from 5 repositories to 500?
Scripts that work for five repositories fail at scale in predictable ways: onboarding, rate limits, ownership, noise and reporting. What to plan for.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.