Security Guides
PostgreSQL predefined roles: least privilege without superuser
Use PostgreSQL predefined roles like pg_read_all_data and pg_monitor instead of superuser, and avoid the three file and program roles.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
PostgreSQL point-in-time recovery: how it works and how to test it
PostgreSQL PITR combines a base backup with archived WAL. Here is how the pieces fit, the settings that matter, and a restore drill to prove it works.
Oct 18, 20263 min read
Security Guides
PostgreSQL logging for security without leaking passwords
Which PostgreSQL log settings help security reviews, and why log_statement = all can write plaintext passwords into your logs.
Oct 18, 20263 min read
Security Guides
Post-quantum cryptography myths versus facts
Seven common claims about quantum computing and encryption, checked against NIST and CISA statements: what is true, what is overstated, and what to do.
Oct 18, 20263 min read
Security Guides
Pod Security admission exemptions: what to exempt and what to avoid
Exemptions skip Pod Security checks entirely. Exempt narrowly, never controller accounts, and review the list. Here is how the exemption types work.
Oct 18, 20263 min read
Security Guides
Pod Security admission: roll out enforce, audit and warn safely
Pod Security admission uses three namespace label modes. Start with warn and audit, fix findings, then enforce. Covers the Deployment caveat.
Oct 18, 20263 min read
Security Guides
How to write a migration plan away from SMS codes
NIST SP 800-63B asks services that offer SMS codes for a migration plan. Here is an outline: alternatives, notice, SIM change checks and a clear trigger.
Oct 18, 20263 min read
Security Guides
PKCE explained: code verifier, code challenge and S256
PKCE stops a stolen authorization code from being redeemed. Learn how the verifier and challenge work, why S256 beats plain, and who must use it.
Oct 18, 20263 min read
Security Guides
Who should be in your patch pilot group, and how to recruit them
Picking the right pilot users makes patch testing useful. What to look for, how to ask for volunteers and how to protect critical teams if a patch fails.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.