Security Guides
OWASP Smart Contract Top 10 (2025): a plain guide to each risk
The ten smart contract risks on OWASP's 2025 list in plain words, what each means for a code reviewer, and where to start if you can only fix two.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
OWASP ASVS or SAMM: which one answers your question?
ASVS lists requirements for verifying a web application. SAMM measures a software security program. A short guide to using each one correctly.
Oct 18, 20263 min read
Security Guides
Which OWASP API Top 10 risks can a scanner find automatically?
A scanner reliably covers parts of API2, API4, API7 and API8 from the OWASP API Top 10 2023, but object and function authorization needs scripted tests.
Oct 18, 20263 min read
Security Guides
Outside collaborators and base permissions in a GitHub organization
How base permissions and outside collaborators work in a GitHub organization, who they apply to, and a simple least privilege setup for contractors.
Oct 18, 20263 min read
Security Guides
Outdated vs vulnerable dependencies: what is the difference?
An outdated dependency has a newer release. A vulnerable one matches a published advisory. The two lists overlap, and each needs its own command.
Oct 18, 20264 min read
Security Guides
Out-of-band incident communications: lessons from CSRB and CISA
Two official reports say attackers watched responders. How to set up an incident channel you can use when email and chat may be compromised.
Oct 18, 20263 min read
Security Guides
How do OSV version ranges work, and where can scans go wrong?
OSV records use SEMVER, ECOSYSTEM and GIT ranges. Learn what introduced, fixed and last_affected mean and which choices create false negatives.
Oct 18, 20263 min read
Security Guides
What happens to vulnerability exceptions when the owner leaves?
Exceptions owned by someone who left have no one watching them. How to find orphaned exceptions, reassign them, and stop it happening again.
Oct 18, 20263 min read
Security Guides
What does the OpenSSF guide for evaluating open source say to check?
A plain summary of the OpenSSF Concise Guide for Evaluating Open Source Software: its seven sections, and how to turn them into a team routine.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.