Security Guides
How do I know if a new zero-day affects my software?
How to tell whether a new zero-day affects you: match the product and version against an inventory, check transitive dependencies, and mark unknowns.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How should daily EPSS scores change what you rescan first?
EPSS publishes scores daily, so priority can shift overnight. How to use it as a ranking signal on rescans, and why it should not be your only one.
Oct 18, 20263 min read
Security Guides
How coverage-guided fuzzing works, in plain words
A coverage-guided fuzzer mutates inputs, tracks which code they reach, and keeps those that reach something new. Here is the loop and why it beats random.
Oct 18, 20264 min read
Security Guides
How are hardcoded secrets detected in source code?
Secret scanners find hardcoded credentials with known patterns, entropy checks and context rules. Here is how each works and where false results come from.
Oct 18, 20263 min read
Security Guides
Why your status page must not run on your own infrastructure
A status page that goes down with your product tells customers nothing. Separate its hosting, DNS, login and notifications from the system it reports on.
Oct 18, 20262 min read
Security Guides
Hospital downtime checklist for a large cyber incident
What an ASPR TRACIE downtime checklist asks hospital operations to prepare before a cyber incident: go-bags, paper forms, runners and manual care.
Oct 18, 20263 min read
Security Guides
Honest publish and updated dates on technical pages
Show a visible date, match it in datePublished and dateModified, and only bump it when content really changes. What Google's date guidance says.
Oct 18, 20263 min read
Security Guides
HMAC or a hash of key plus message for signing API requests?
Sign API requests with HMAC, not a plain hash of secret plus message. Why the shortcut is risky, what to include in the signed string, and how to verify.
Oct 18, 20263 min read
Security Guides
HKDF or a password hash: which key derivation function to use
HKDF turns strong secret material into keys but is not for passwords. Argon2id, scrypt or PBKDF2 slow down guessing. How to choose for each job.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.