Security Guides
Where should Azure DevOps pipeline secrets live?
Prefer no secret, then Azure Key Vault, then variable groups, then pipeline secret variables. How each scopes access and what log masking cannot protect.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Should you tick 'Grant access to all pipelines' on a service connection?
Microsoft advises against granting every pipeline access to an Azure DevOps service connection. What the option does and how to authorize pipelines singly.
Oct 18, 20263 min read
Security Guides
How does the Azure DevOps required template check enforce pipelines?
The required template check makes a pipeline extend an approved YAML template before it can use a protected resource. How it works, and where it stops.
Oct 18, 20264 min read
Security Guides
How do you build pull requests from forks in Azure DevOps safely?
Fork pull request builds can run untrusted code. Azure DevOps has settings to withhold secrets, cut permissions, and require a team member comment first.
Oct 18, 20264 min read
Security Guides
Which Azure DevOps policies control personal access tokens?
Azure DevOps has tenant and organization policies to restrict global and full scoped PATs, cap lifetime, limit creation, and auto revoke leaked tokens.
Oct 18, 20263 min read
Security Guides
Which Azure DevOps minimum reviewer options actually enforce review?
The Azure DevOps minimum reviewer policy has settings that decide whether approval means anything: self approval, most recent pusher, and vote resets.
Oct 18, 20264 min read
Security Guides
What is job authorization scope in Azure DevOps and which setting?
Job authorization scope sets whether an Azure DevOps pipeline runs with a project or collection identity. Turn on the project limit and protect YAML repos.
Oct 18, 20264 min read
Security Guides
Azure DevOps global PATs stop on 1 December 2026: what to do now
Microsoft says Azure DevOps global PATs stop working on 1 December 2026. Find them, replace them with scoped tokens or Entra auth, and test before then.
Oct 18, 20263 min read
Security Guides
When does an Azure DevOps build validation result go stale?
Azure DevOps build validation can expire when the target branch moves. See the three expiration options and which to pick so merged code was really built.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.