Security Guides
Which cookie flags should a code review check on session cookies?
Check Secure, HttpOnly and SameSite on session cookies, the __Host- prefix, a narrow Domain scope and a fresh session ID at login. Based on MDN.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Container scan shows hundreds of vulnerabilities: what to do first
A long scan report on a container image is usually mostly base image noise. Here is how to shrink it, what to fix first, and which findings you can park.
Oct 18, 20263 min read
Security Guides
Container image scanner or dependency scanner: do you need both?
A dependency scanner reads app packages, an image scanner reads OS layers too. When you need both, when one is enough, and how to avoid overlap.
Oct 18, 20263 min read
Security Guides
Scan container images in CI or in the registry?
CI scans stop bad images before they ship, registry scans catch new advisories on images already stored. Most teams need both. A decision table and steps.
Oct 18, 20263 min read
Security Guides
In a supply chain incident, do you contain first or investigate first?
Contain first when harm is ongoing, but capture evidence in the same hour. A decision guide for the most common call in the first hour of an incident.
Oct 18, 20263 min read
Security Guides
Compare secrets in constant time: why == is the wrong check
Use a constant-time compare for tokens, MACs and signatures. A plain equals check can leak how many leading bytes matched. What to use in each language.
Oct 18, 20264 min read
Security Guides
Make consent withdrawal reach every downstream system
When a user withdraws consent, every system and vendor using it must stop. How to design the event, the checks, and the proof that it worked.
Oct 18, 20263 min read
Security Guides
Consent logging: which fields to store as proof of consent
What a consent log should store to prove consent under GDPR: who, when, the exact text and version, how, and any withdrawal. Includes a sample schema.
Oct 18, 20263 min read
Security Guides
How do you confirm a DAST finding is real before filing a ticket?
Replay the exact request, change one thing, and read the response yourself. A five step routine for confirming a DAST alert before it becomes a ticket.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.