Security Guides
Which test finds what: SAST, DAST and IAST by flaw type
A matrix of which testing type is best placed to find injection, access control, configuration, secrets and crypto flaws, based on OWASP guidance.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Does your SAST tool need to build your code? What to check
Some static analysis tools need a working build, others read raw source. How to tell which you are buying and why it affects setup, speed and coverage.
Oct 18, 20263 min read
Security Guides
How many findings do you need to sample to estimate false positives?
How many scanner findings to review to estimate your false positive rate: the formula, three worked sample sizes, and when a small sample is enough.
Oct 18, 20263 min read
Security Guides
SAML vs OIDC: which sign-in protocol fits your app?
Choosing between SAML and OpenID Connect for single sign-on: where each fits, what each sends, and the security work each leaves on your side.
Oct 18, 20263 min read
Security Guides
SAML assertion validation checklist for service providers
What a SAML service provider must verify before it accepts a login: signature, Destination, Audience, time bounds, InResponseTo and replay checks.
Oct 18, 20263 min read
Security Guides
SameSite Lax, Strict or None: which cookie setting to use
Lax suits most session cookies, Strict suits sensitive ones, and None is only for cookies a third party must receive. Here is how to choose for each one.
Oct 18, 20263 min read
Security Guides
Saltzer and Schroeder's 1975 design principles, applied today
Eight security design principles from a 1975 paper still describe good practice. Here is each one with a modern example from everyday engineering work.
Oct 18, 20263 min read
Security Guides
Safety integrity levels (SIL 1 to 4): what they mean and common errors
SIL measures the risk reduction a safety function gives. Learn how SIL is set, the failure probability bands, and why a SIL 2 label on software is wrong.
Oct 18, 20263 min read
Security Guides
Safety instrumented system vs process control system: the difference
A safety instrumented system shuts a process down when it sees danger; a process control system runs normal operation. Why they must stay independent.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.