Security Guides
Does HIPAA require you to patch vulnerabilities?
HIPAA names no patch deadline, but risk management and malicious software duties point to timely fixes. See what is required and how to prioritise.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Does Docker use a seccomp profile by default?
Yes. Docker applies a default seccomp allowlist that blocks around 44 of 300+ system calls. Here is how to confirm it and what unconfined removes.
Oct 18, 20264 min read
Security Guides
What should asset discovery find? Questions to ask any security vendor
Asset discovery claims range from listing repositories to mapping live services. Ask what it finds, how it connects, how often it runs and what it misses.
Oct 18, 20263 min read
Security Guides
Does an AppSec scanner send your source code to the vendor?
It depends on the architecture: local scan, metadata only, or full upload. How to find out what leaves your network before you sign, with a data table.
Oct 18, 20263 min read
Security Guides
Does Airflow mask secrets in task logs, and what does it miss?
Airflow masks connection passwords and sensitive variables by value in logs and the UI, but not XCom or environment variables. Here is what to do about it.
Oct 18, 20263 min read
Security Guides
Does an AI assistant rate severity the same way CVSS does? How to test
AI tools often label findings critical or low on their own scale. Compare them with CVSS bands on 20 known findings, and learn why severity is not risk.
Oct 18, 20264 min read
Security Guides
Does a software vendor need a security.txt file, and what should it say?
RFC 9116 defines security.txt: where it lives, the two required fields, and why an expired file is a small but real signal when you review a vendor.
Oct 18, 20263 min read
Security Guides
Does a smaller container image mean fewer vulnerabilities?
Usually fewer packages means fewer findings, but size is only a proxy. Learn what to measure instead, with a myth versus fact table and a test to run.
Oct 18, 20264 min read
Security Guides
Does a vulnerability in a SaaS product get a CVE?
A flaw that exists only in a hosted service can carry a CVE record, marked exclusively-hosted-service. What the tag means and when not to use it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.