Security Guides
umask 022 vs 027: which default for new files on a server
The umask removes permission bits from new files. Learn what 022 and 027 produce, how systemd's UMask= sets it for services, and when ACLs override it.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What is a mix-and-match attack on a signed U-Boot FIT image?
Signing only images lets an attacker pair signed kernels and device trees in a new set. Signed FIT configurations close that gap. Rollback is separate.
Oct 18, 20263 min read
Security Guides
How do you run a two week proof of concept for automated fix PRs?
A two week proof of concept plan for automated fix PRs: scope, success criteria, what to measure, and the questions to settle before you buy.
Oct 18, 20263 min read
Security Guides
Two vulnerabilities, same priority: which do you fix first?
When two findings tie on severity and exploit signals, use tie-breakers: exposure, reachability, blast radius, and fix effort. A short ordered list.
Oct 18, 20264 min read
Security Guides
Two-person review when you are the only maintainer
A solo maintainer cannot review their own code, but can still get a second pair of eyes on risky changes. Here is a workable, low-effort setup.
Oct 18, 20264 min read
Security Guides
Turning SELinux back on after it was disabled: safe order of steps
Enable SELinux in permissive mode first, read the denials, relabel, then switch to enforcing. The order that avoids unbootable systems, per Red Hat docs.
Oct 18, 20263 min read
Security Guides
Turn on automatic updates on every family device
Why updates matter at home and how to make them automatic: a household checklist for phones, tablets, computers, consoles and the apps children use.
Oct 18, 20263 min read
Security Guides
Turn off the SMS fallback after you add an authenticator
Adding an authenticator does not remove SMS codes from an account. Why that leaves a weak back door, and how to close it without locking yourself out.
Oct 18, 20263 min read
Security Guides
What are true positives, false positives and false negatives in AppSec?
A true positive is a real bug found, a false positive is a wrong alarm, a false negative is a real bug missed. A table, an example and how to measure each.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.