Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
What nginx stub_status reveals, why it needs an allow and deny rule, and how to publish metrics to a monitor without leaving the page open to the internet.
What nginx's ssl_protocols, ssl_session_tickets, ssl_stapling and ssl_early_data defaults are, which are safe to leave, and which need a decision.
Does server_tokens off make nginx secure? What it changes in the Server header and error pages, what it cannot do, and what to do about patching instead.
How set_real_ip_from, real_ip_header and real_ip_recursive pick the client address nginx logs and limits, and how broad trust lets users spoof it.
nginx does not verify the certificate of an https upstream unless you set proxy_ssl_verify on. The directives needed to verify, name check and send SNI.
How nginx limit_req works: the zone, the rate, burst and nodelay, why rejected requests return 503 by default, and how to test a limit with dry run.
limit_conn caps concurrent connections per key and limit_req caps request rate. Use each for the right problem, with HTTP/2 counting and dry run to test.
How nginx picks a server block, why the first one becomes the default, and how a catch-all with ssl_reject_handshake refuses names you do not own.
nginx add_header inheritance drops server level headers when a location defines its own, and without always it skips most error codes. How to avoid both.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
