Security Guides
Write a one page internal brief on a security story
A short template for briefing your team on a breach or vulnerability in the news: what happened, whether it applies, what we did, and what happens next.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
An on-call shadowing plan for new security hires
How to bring a new hire onto a security on-call rotation in stages: read, shadow, reverse shadow, then primary, with what to check before each step.
Oct 18, 20263 min read
Security Guides
On-call health metrics for a security team's quarterly review
Six simple measures of pager health for a security team, from pages per shift to toil share, plus thresholds borrowed from Google's SRE guidance.
Oct 18, 20263 min read
Security Guides
On-call handoff checklist for a security team
A practical checklist for passing the pager between security responders, built on the handoff practice in Google's SRE incident management chapter.
Oct 18, 20263 min read
Security Guides
On-call pay or time off: how to compensate security responders
Time off in lieu or cash, with a cap, is how Google's SRE book handles on-call compensation. Options for a security team and why a cap protects people.
Oct 18, 20263 min read
Security Guides
OIDC ID token validation steps: a checklist for relying parties
What an app must check before trusting an OpenID Connect ID token: issuer, audience, signature, expiry, nonce and more, in the order the spec lists.
Oct 18, 20263 min read
Security Guides
OIDC back-channel logout: how to end sessions across apps
Back-channel logout lets an identity provider tell each app to end a user's session by server call. See the logout token, the checks and the limits.
Oct 18, 20263 min read
Security Guides
Offline encrypted backups against ransomware: a checklist
Ransomware often hunts for backups first. What CISA's guide says about offline, encrypted backups and testing, and a checklist you can work through.
Oct 18, 20263 min read
Security Guides
Myth vs fact: extensions from the official store are safe
Official extension stores run reviews and enforce policies, but listing is not a safety guarantee. Here is what the stores promise and what they do not.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.