Security Guides
How do you threat model a login feature with STRIDE?
Walk a login feature through STRIDE: credential stuffing, user enumeration, lockout abuse and session theft, each tied to a mitigation from OWASP guidance.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you threat model a Kubernetes deployment? What to draw
Threat model a Kubernetes deployment by drawing the control plane, workloads and network, then checking access, secrets, pod controls, admission and audit.
Oct 18, 20263 min read
Security Guides
How do you threat model a file upload feature?
A step by step threat model for a file upload feature: draw the flow, apply STRIDE, then map each threat to the OWASP upload defenses and a test.
Oct 18, 20263 min read
Security Guides
Your vendor was breached: how to tell your own customers
When a supplier's breach touches your customers' data, you still owe them a clear message. Decide what to verify, what to say and when to say it.
Oct 18, 20262 min read
Security Guides
Test your kill switch: a monthly drill checklist
A kill switch nobody has pulled in a year may not work. A short monthly drill checklist covering access, speed, side effects, logging and the way back.
Oct 18, 20263 min read
Security Guides
How to test whether a scanner's advisory data is fresh
A one afternoon test for advisory freshness: pick recent public advisories, time how long each takes to appear in your scanner, and what to ask the vendor.
Oct 18, 20263 min read
Security Guides
How to test a vendor's reachability claim before you trust it
Reachability analysis can cut noise sharply, but only if it is right. A short test plan to verify a vendor's claim on your own code and call paths.
Oct 18, 20263 min read
Security Guides
Testing SCA against private registries and internal packages
How to check that an SCA tool handles private registries, internal packages and name collisions with public ones before you rely on its results.
Oct 18, 20263 min read
Security Guides
Test data privacy: synthetic, masked or subsetted data?
A decision guide to the three ways of getting realistic test data without copying personal data into test systems, with the tradeoffs of each.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.