Security Guides
What runs when you open an Unreal project? init_unreal.py explained
Unreal runs init_unreal.py and project startup scripts automatically when the Python plugin is on. What that means for code you did not write.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What runs when a fork opens a pull request against your template CI?
A fork pull request triggers your starter workflow with limited rights and sometimes a maintainer approval step. Here is what gets access and why.
Oct 19, 20263 min read
Security Guides
What software reaches end of life before January 2027? A 90 day list
A dated watchlist of runtimes and frameworks whose support ends between now and the end of 2026, from official pages, with a plan to check your inventory.
Oct 19, 20264 min read
Security Guides
What permissions should the GitHub Actions token have?
Set the GITHUB_TOKEN default to read-only for contents, then grant write access per job. Here is how to do it and what breaks when you tighten it.
Oct 19, 20264 min read
Security Guides
What permissions should a security automation token have?
Give each security automation its own service account and a token scoped to the few actions it needs. A permission matrix and rotation habits.
Oct 19, 20263 min read
Security Guides
What does OWASP say about securing a backend database?
OWASP's database cheat sheet covers isolation, TLS, per-app accounts, credential storage and least privilege. Here is a plain language checklist from it.
Oct 19, 20264 min read
Security Guides
What does OWASP API9 say about the third parties your API talks to?
OWASP API9 covers more than old API versions. It also asks for an inventory of integrated services and the sensitive data you share with them.
Oct 19, 20264 min read
Security Guides
What outcomes can a security gate have? Define the states first
A security gate has more outcomes than pass and fail. Define seven states first so your gate outcome metrics stay consistent, comparable and auditable.
Oct 19, 20263 min read
Security Guides
What should you never put on a public security page?
A public security page should show posture, not hand attackers a map. See what to keep off it, what to gate behind a request, and what to publish freely.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.