Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
The FBI Denver office warned about public USB ports in 2023 without citing an incident. What is documented, what is not, and cheap habits that cover it.
Trusted Jenkins shared libraries run outside the sandbox, so who can push to them matters. How trusted and untrusted differ, and how to pin versions.
Script Security lets non-admins run Groovy through a whitelist sandbox or an admin approval queue. Here is how each works and how to approve safely.
The Jenkins reverse proxy warning means requests or responses are not rewritten correctly. What causes it, what it breaks, and how to check your proxy.
When a Jenkins plugin has no fix, the project publishes an advisory and may suspend distribution. Here is how it works and what an admin should do next.
Reference credentials by ID, bind them with withCredentials or credentials(), use single quotes in shell steps, and treat masking as partial protection.
Pinned plugins and implied dependencies are two upgrade traps in older Jenkins. What each means, how to spot them, and how to avoid a broken update.
A short Jenkins hardening checklist: no anonymous access, builds off the controller, agent access control on, scoped credentials, and sandboxed Groovy.
Jenkins CSRF protection uses a crumb tied to the user and session. Learn how it works, how scripts handle it, and why disabling it is a poor fix.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
