Security Guides
Forwarded header versus X-Forwarded-For: what RFC 7239 adds
The standard Forwarded header carries client, proxy, host and protocol in one field. How it compares with X-Forwarded-For, and why neither is safe.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Fork pull request workflow settings on GitHub, explained
How the GitHub Actions approval options for fork pull requests work, the default level, and the catch for contributors who already had one commit merged.
Oct 18, 20263 min read
Security Guides
Are sidecars and init containers in your vulnerability scans?
Sidecar and init container images run with your pods but often escape scans. How to find them in a cluster, who owns them, and how to cover them.
Oct 18, 20263 min read
Security Guides
Forced password reset: how to tell customers without causing panic
A checklist for communicating a forced password or credential reset to customers: wording, links, phishing safety, timing and support readiness.
Oct 18, 20263 min read
Security Guides
A one hour failure mode review for a service you own
A lightweight failure mode and effects review for one service: list dependencies, ask what happens when each fails, and decide which fail safe or secure.
Oct 18, 20263 min read
Security Guides
What does the Flask SECRET_KEY protect, and how do you rotate it?
Flask uses SECRET_KEY to sign the session cookie. How to generate one, why signed is not encrypted, and how SECRET_KEY_FALLBACKS (Flask 3.1) rotates it.
Oct 18, 20264 min read
Security Guides
Does Flask's Jinja autoescape stop all XSS? What it misses
Autoescape handles most template XSS but not unquoted attributes, javascript: URLs, Markup on user data, or HTML from uploaded files. Rules to follow.
Oct 18, 20264 min read
Security Guides
What should you fix before launching a bug bounty program?
Clear what automated scanners can already find before you invite researchers to look. A short checklist to cut duplicate and low value reports.
Oct 18, 20263 min read
Security Guides
Why fix internet-facing systems first, and how do you rank the rest?
A simple ranking for small teams: exploited and exposed first, exposed second, internal third. Scores break ties instead of deciding the order.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.