Security Guides
Do containers need the host kernel patched?
Yes. Containers rely on the host kernel for isolation, so rebuilding an image never fixes a kernel flaw. Patch the node and plan the reboot.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Do your backups contain plaintext secrets? How to check and fix it
Backups copy everything, including API keys, tokens and passwords. How to find secrets in database dumps and config backups, and what to do about them.
Oct 18, 20263 min read
Security Guides
Does a library's test suite matter when you are choosing it?
Tests do not prove security, but they make fixes safer to ship. What to check in a dependency's CI, and what Scorecard and the badge say about testing.
Oct 18, 20264 min read
Security Guides
Should you run dnf upgrade with the security flag or a full upgrade?
Use the security flag to apply only advisory backed fixes, and a full upgrade for planned maintenance. Learn how to preview with dnf updateinfo first.
Oct 18, 20264 min read
Security Guides
Why did Django drop the pickle session serializer for JSON?
A leaked SECRET_KEY plus pickled cookie sessions becomes remote code execution. Django removed PickleSerializer in 5.0. What to check on older projects.
Oct 18, 20264 min read
Security Guides
Is Django ModelForm fields = '__all__' a mass assignment risk?
Yes, it can be. fields = '__all__' or exclude lets new model fields become editable by users. Use an explicit fields list and test what a form accepts.
Oct 18, 20264 min read
Security Guides
What do Deferred, Ignored and Needs evaluation mean on a CVE page?
Linux distributions label CVEs as Needs evaluation, Not affected, Deferred or Ignored. What each status means for your scan and what you should do.
Oct 18, 20264 min read
Security Guides
Vulnerability report intake: web form, email or both?
Compare web form, shared mailbox and platform intake for security reports, with trade-offs for spam, encryption, tracking and researcher experience.
Oct 18, 20263 min read
Security Guides
Should you disable UART and JTAG debug ports before shipping a device?
Yes. ETSI EN 303 645 says a physically accessible debug interface shall be disabled in software. How to handle UART and JTAG across a product line.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.