Security Guides
Integration test checklist for tenant isolation
Ten integration tests that prove one customer cannot read or change another customer's data through IDs, search, exports, background jobs and caches.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Which independent sources can verify a scanner finding?
Check a finding against OSV for affected versions, CISA KEV for exploitation and CWE for the weakness class. A quick routine for verifying scanner output.
Oct 18, 20263 min read
Security Guides
Incident holding statement template: write it before you need it
A holding statement is the short public line you issue while facts are still unknown. Learn what to include, what to leave out and how to pre-approve it.
Oct 18, 20263 min read
Security Guides
Who should evaluate a security tool: your team or a third party?
Your team knows your code. A third party brings distance and method. A decision guide on when to evaluate in house, hire an outside evaluator, or do both.
Oct 18, 20263 min read
Security Guides
What should you do when an image vulnerability has no fix yet?
No patch for a finding in your container image? Check exploitability, shrink exposure, add a compensating control, set an expiry and keep watching.
Oct 18, 20263 min read
Security Guides
Image scanning vs cluster scanning vs runtime detection: which do I need?
Image scanning, cluster scanning and runtime detection answer different questions. A comparison table and a sensible order to adopt each one.
Oct 18, 20263 min read
Security Guides
Embed a third-party widget as an iframe or a script tag?
A sandboxed cross-origin iframe limits what a vendor widget can reach, while a script tag gives it your whole page. Use this guide to pick per widget.
Oct 18, 20263 min read
Security Guides
If R8 removes unused library code, is my Android app still affected?
R8 shrinking can remove unreferenced library code, but that is not a vulnerability assessment. When it helps, when keep rules undo it, and how to decide.
Oct 18, 20263 min read
Security Guides
You typed your password on a fake page: your first hour
What to do in the first hour after you respond to phishing: change passwords, scan the device, report it, and decide whether money or identity is at risk.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.