Security Guides
SSVC outcomes explained: Track, Track*, Attend and Act
CISA's SSVC decision tree ends in Track, Track*, Attend or Act. See what each outcome asks of you and which five inputs drive the decision.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
SSVC Automatable: can an attacker script it end to end?
The SSVC Automatable decision point asks whether attackers can reliably automate four kill chain steps. See when it is no, when it is yes, and the default.
Oct 18, 20264 min read
Security Guides
SSRF in webhook features: allow-list or deny-list for URLs?
Prefer an allow-list of destinations. When users can enter any URL, as with webhooks, use a deny-list plus network controls. Here is how to decide.
Oct 18, 20263 min read
Security Guides
SSRF and DNS rebinding: validate the IP you actually connect to
Checking a hostname's DNS answer before a request is not enough. Learn why rebinding beats it and how to validate resolved IPs at connection time.
Oct 18, 20263 min read
Security Guides
SSRF defence for webhooks: allowlist or denylist?
Use an allowlist when destinations are known. For user supplied webhook URLs a denylist is a last resort, so add network limits and connection time checks.
Oct 18, 20263 min read
Security Guides
Six sshd_config settings to check before you SSH in from anywhere
Six OpenSSH server settings worth reviewing before you expose a host to remote logins: defaults, what each does and what to change, from the man page.
Oct 18, 20264 min read
Security Guides
How to add Subresource Integrity to scripts and stylesheets
Subresource Integrity lets the browser refuse a CDN script or stylesheet whose bytes changed. Here is how to add it, generate hashes and keep them current.
Oct 18, 20264 min read
Security Guides
Amazon SQS encryption at rest: SSE-SQS or SSE-KMS?
What SQS server-side encryption protects, what it leaves out, and how to choose between SQS-managed keys and KMS keys for your queues.
Oct 18, 20263 min read
Security Guides
SQS dead-letter queues: settings that matter for security
Dead-letter queues hold failed messages, often with real data. Learn the redrive and retention settings that decide who can use them and how long data sits.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.