Security Guides
What should you do if your Rails master.key leaks?
If a Rails master.key leaks, treat every credential in the file as exposed. Generate a new key, re-encrypt, rotate each secret, and expect sessions to end.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Do you need config.hosts in Rails production?
Yes. Rails only checks the Host header in development by default. Set config.hosts in production to block DNS rebinding and host header attacks.
Oct 18, 20263 min read
Security Guides
Rails credentials or environment variables: where do secrets go?
Rails encrypted credentials can live in Git if the master key stays safe. Environment variables suit per-host values. Compare both and pick for your team.
Oct 18, 20263 min read
Security Guides
Questions to ask when a tool claims it finds zero days
Zero-day discovery is easy to claim and hard to verify. Ask what counts as one, how findings are confirmed, how they are disclosed and what you receive.
Oct 18, 20263 min read
Security Guides
Python .pth files run code at startup: how to check yours
A malicious litellm release used a .pth file to run on every Python start. How .pth files work, what a safe one looks like and a quick audit.
Oct 18, 20263 min read
Security Guides
Do Python extras and environment markers change what a scan reports?
Extras add optional packages and markers switch dependencies on or off by platform. Learn why a scan of one machine can differ from another.
Oct 18, 20263 min read
Security Guides
Does your scanner match PyPI names like Foo_Bar and foo-bar?
Python treats Foo_Bar, foo.bar and foo-bar as one package. A scanner that compares raw strings can miss a vulnerable match. Here is how to test yours.
Oct 18, 20264 min read
Security Guides
Purpose limitation in code: tag data with the reason you hold it
GDPR purpose limitation means reusing data only for compatible purposes. How to tag fields and queries by purpose so reuse is visible and reviewable.
Oct 18, 20263 min read
Security Guides
Publishable, secret or restricted API key: which goes where?
Payment platforms issue several key types. Which are safe in front end code, which belong on the server, and why restricted keys limit the damage.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.