Security Guides
Does Spring Boot enable @PreAuthorize automatically?
No. Spring Boot Starter Security does not activate method level authorization. Add the method security annotation or your PreAuthorize rules do nothing.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What is a good Spring Boot dependency hygiene checklist?
A practical Spring Boot dependency hygiene checklist: stay on a supported line, use the BOM, override carefully, inventory the JAR, gate vulnerable builds.
Oct 18, 20263 min read
Security Guides
Should the Actuator health endpoint show details?
The health endpoint hides details by default. When to use never, when-authorized or always, and how roles decide who sees component status.
Oct 18, 20263 min read
Security Guides
Does Spring Boot Actuator hide secrets in the env endpoint?
By default Actuator replaces values from env, configprops and quartz with asterisks. The show-values setting can change that, so check who can see them.
Oct 18, 20263 min read
Security Guides
SPIFFE IDs and SVIDs explained for service identity
What a SPIFFE ID, trust domain and SVID are, why X.509 SVIDs are preferred over JWT, and what the Workload API removes from your deployment.
Oct 18, 20263 min read
Security Guides
Spending open source sponsorship money on security first
If your project gets even small funding, five security purchases and time investments cut risk more than most features. A prioritised list for maintainers.
Oct 18, 20263 min read
Security Guides
Git sparse checkout is not access control for a monorepo
Sparse checkout trims files in your working directory. It does not hide history or restrict anyone. Why it cannot enforce monorepo permissions.
Oct 18, 20263 min read
Security Guides
Spam texts about packages and prizes: what a family should do
Fake delivery, prize and account alert texts are common. What the FTC says to do: do not click, check independently, forward to 7726, and report.
Oct 18, 20263 min read
Security Guides
What is a software supply chain? A restaurant kitchen analogy
The software supply chain explained with a restaurant kitchen: suppliers, ingredient labels, recalls and the kitchen, with the matching technical terms.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.