Security Guides
Secrets in your RAG index: scan before you ingest
Credentials in wikis and tickets can end up in a vector index and be retrieved on request. How to find and remove secrets before and after ingestion.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
seccomp, AppArmor or SELinux: which does Kubernetes need?
Start with non-root and the runtime default seccomp profile, then add AppArmor or SELinux depending on your node OS. A short decision guide.
Oct 18, 20263 min read
Security Guides
SCIM offboarding: deactivate vs delete, and what must also end
Setting a SCIM user to inactive does not always end their access. A checklist for deactivation, deletion, sessions, tokens and audit evidence.
Oct 18, 20263 min read
Security Guides
What SCIM does: user provisioning explained for security teams
SCIM is the standard way an identity provider creates, updates and removes accounts in other apps. What it covers, what it leaves out, and why it matters.
Oct 18, 20263 min read
Security Guides
A school ransomware prevention checklist built from CISA guidance
A practical ransomware prevention checklist for schools and small organizations, drawn from CISA's StopRansomware guide: backups, MFA, patching, access.
Oct 18, 20263 min read
Security Guides
Scanner terms FAQ: SAST, SCA, IaC, CSPM and secrets scanning
Plain answers to common questions about scanner acronyms: what each stands for, what it reads, when it runs and what it is often confused with.
Oct 18, 20263 min read
Security Guides
How to calculate the precision of your scanner findings
Precision tells you what share of scanner findings are real. Here is how to estimate it from a small sample, and why it is not the same as recall.
Oct 18, 20263 min read
Security Guides
Scanner adoption for a five person startup: what to run and skip
With five engineers and no security hire, run secrets scanning and SCA now, add container and IaC checks in CI, and postpone CSPM and heavy SAST.
Oct 18, 20263 min read
Security Guides
Scan a local Docker image before you push it
How to export a local Docker image with docker save, what the archive holds, and how to check an image for vulnerable packages before it hits a registry.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.