Security Guides
How do I review a build.rs file for safety in ten minutes?
A quick checklist for reviewing a Rust build script: normal behavior, red flags like network calls and writes outside OUT_DIR, and what to record.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Reverse proxy security review: a 15 point checklist
A checklist for reviewing an nginx, Apache or Caddy reverse proxy: identity, TLS, headers, limits, caching, exposed endpoints and patching, with tests.
Oct 18, 20263 min read
Security Guides
Reverse proxy caching and logged-in pages: avoid leaking responses
How shared caches in a proxy or CDN can serve one user's page to another, and which Cache-Control values (private, no-store, no-cache, public) prevent it.
Oct 18, 20263 min read
Security Guides
Should you reuse the same private key when you renew a certificate?
Reuse the private key at renewal, or generate a new one? Certbot defaults to a new key. The pros and cons, and when key pinning changes the answer.
Oct 18, 20263 min read
Security Guides
Retro prompts for security after an incident or scare
A retrospective after a security scare can drift into blame. Use these prompts to keep it about systems, decisions and the next change you will make.
Oct 18, 20263 min read
Security Guides
How do I restrict which GitHub Actions my organization can run?
Use the organization Actions policy to allow only local, GitHub-authored, verified or named actions, and require full-length commit SHA pinning.
Oct 18, 20264 min read
Security Guides
Restrict an SSH key to one job with authorized_keys options
Use restrict, command and from in authorized_keys so a backup or deploy key can do one thing from one place. Syntax and pitfalls from the sshd manual.
Oct 18, 20263 min read
Security Guides
A reporter wants payment or threatens to go public: how to respond
Pressure after a security report is stressful for a volunteer maintainer. Stay calm, keep records, stick to your policy, and know when to get help.
Oct 18, 20263 min read
Security Guides
Replacing a legacy vulnerability scanner: a migration checklist
A checklist for swapping out an older vulnerability scanner: scope, parallel runs, policy rules, integrations and the evidence you must keep for auditors.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.