Security Guides
Should you study the OWASP Top 10 2025 in order? A study plan
The OWASP Top 10 2025 lists ten risk categories. Here is a practical order to study them if you are new to AppSec, with one exercise for each group.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Should you still use the OAuth implicit flow in 2026?
No for new apps. The OAuth security BCP says clients should not use the implicit grant. Here is why it fell out of favour and what to use instead.
Oct 18, 20264 min read
Security Guides
Should you pin Let's Encrypt intermediate certificates in your app?
Pinning a Let's Encrypt intermediate is fragile: the authority runs several, and backups can start issuing without warning. What to pin or trust instead.
Oct 18, 20263 min read
Security Guides
Should you log HTTP request bodies? When it helps and when it hurts
Default to no. Log metadata, not request bodies, because bodies carry passwords, tokens and personal data. Safe patterns for the few cases that need more.
Oct 18, 20264 min read
Security Guides
Should you disable gRPC reflection in production?
gRPC reflection lets any client list your services and messages. Learn what it exposes, when to switch it off, and how to check a live server in minutes.
Oct 18, 20264 min read
Security Guides
Should you disable FastAPI /docs and /openapi.json in production?
FastAPI serves /docs, /redoc and /openapi.json by default. When to turn them off, how with docs_url=None and openapi_url=None, and what that does not fix.
Oct 18, 20263 min read
Security Guides
Should you hold a package with apt-mark, and what are the risks?
A hold stops a package from being upgraded or removed, which also blocks security fixes. Use it briefly, record why, and know the safer alternatives.
Oct 18, 20264 min read
Security Guides
Should you accept a vulnerability when a fix PR already exists?
If a policy-gated fix pull request exists, accepting the risk needs a stronger case than before. Questions that decide between merging and an exception.
Oct 18, 20263 min read
Security Guides
Should a vendor's support staff see your production PHI?
Vendor support often needs data access to fix issues, but standing access is a risk. Compare four access models and what to write into the contract.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.