Security Guides
What hidden costs should an AppSec budget include?
Hidden AppSec costs include integration, tuning, triage, developer fix time, exceptions, and migration. A checklist to add them before you commit.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Hashing emails is not anonymization: myth versus fact
A hashed email is still personal data under GDPR, because anyone with a candidate email can compute the same hash. Why, and what to use instead.
Oct 18, 20263 min read
Security Guides
Hash, MAC, signature or encryption: which one does the job?
A decision guide for developers: match the goal to the tool. Fingerprints, tamper checks, proof of origin and secrecy each call for something different.
Oct 18, 20263 min read
Security Guides
How do you check whether an open source library was security audited?
Where to find audit reports, how to read them, and the question that matters most: were the findings fixed? A short guide for dependency selection.
Oct 18, 20263 min read
Security Guides
What is a hardware root of trust, and does your device need one?
A hardware root of trust is the component all other trust derives from, and ETSI EN 303 645 names it as one route to secure boot. What it is, and when.
Oct 18, 20263 min read
Security Guides
Hard-coded credentials in firmware: how they are found, how to avoid
CWE-798 covers hard-coded passwords and keys. ETSI says critical security parameters shall not be hard-coded in source. How to avoid them in firmware.
Oct 18, 20263 min read
Security Guides
A customer reports a vulnerability: steps for an engineering manager
When a customer or researcher reports a flaw in your product, acknowledge fast, reproduce, assign an owner, decide severity and keep the reporter informed.
Oct 18, 20263 min read
Security Guides
Is a gRPC max message size enough to stop denial of service?
A per message size cap does not bound a stream. See which gRPC limits to set for message size, message count, session length and rate, with examples.
Oct 18, 20264 min read
Security Guides
Are gRPC deadlines a security control or just a reliability setting?
gRPC sets no deadline by default. Learn why missing deadlines let slow or stuck calls pile up, and how to set client and server time limits on purpose.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.