Security Guides
What should I check before adding a new R package to a project?
A seven point intake check for an R package: source, license, authors, compiled code, update history, dependencies and a lockfile entry.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What should you back up on a self-hosted package mirror?
Back up internal packages, configuration and user data. Skip the cache of public packages you can refetch. A short backup and restore plan for small teams.
Oct 19, 20263 min read
Security Guides
What should you back up on a client WordPress site?
Back up both the files and the database, keep copies in more than one place, and test a restore. Here is a client site backup plan agencies can adopt.
Oct 19, 20263 min read
Security Guides
What should you back up and escrow before a work trip?
Before a trip, back up code, notes and configs, and escrow recovery keys and second factor backups where you can reach them if the laptop is lost.
Oct 19, 20263 min read
Security Guides
What should you automate first in vulnerability triage at your team size?
A table of what to automate first in vulnerability triage by team size, from solo developers to large engineering groups, and what to keep human.
Oct 19, 20264 min read
Security Guides
What should you automate first in vulnerability remediation?
Automate the waiting and the lookups first: alert routing, enrichment, fix PR creation and verification. Keep risky merges and exceptions with a person.
Oct 19, 20263 min read
Security Guides
What should you ask about uptime and outages in a security tool trial?
Ask a security tool vendor how it handles outages, upgrades and failure modes, and watch what happens during your trial. Questions and checks included.
Oct 19, 20264 min read
Security Guides
What three conditions put a CVE in the CISA KEV catalog?
A CVE joins CISA's KEV catalog when it has a CVE ID, reliable evidence of active exploitation, and a clear fix. Here is what each condition means.
Oct 19, 20264 min read
Security Guides
What should the 'report a vulnerability' section of a trust page say?
A good report-a-vulnerability section names a contact, a policy, what you promise, and what you ask. Use RFC 9116 fields as a checklist for page and file.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.