Security Guides
Seven myths about free vulnerability scan tools
Free scanners are not toys and not magic. Seven common beliefs about free dependency scans, checked against what they can and cannot actually do.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Five myths about desktop security tools, checked
Five common beliefs about desktop security scanners, such as that local means private, signed means safe, or a clean scan means secure, and what is true.
Oct 18, 20263 min read
Security Guides
Myth: our control system is not on the internet. What the advisories show
Public advisories show internet-facing PLCs, remote desktop tools and VPNs reaching control systems. How to test the claim that yours is not exposed.
Oct 18, 20263 min read
Security Guides
MySQL roles: set up least privilege app accounts in 8.4
Use MySQL roles to give app accounts read or write access to one schema. Covers CREATE ROLE, GRANT, SET DEFAULT ROLE and locked role behavior.
Oct 18, 20262 min read
Security Guides
Mutual TLS (mTLS) explained: client certificates and bound tokens
mTLS makes both sides present certificates. See how it works for service authentication, how RFC 8705 binds OAuth tokens to certificates and the ops cost.
Oct 18, 20264 min read
Security Guides
Mutating vs validating admission webhooks: which runs first and why
Mutating webhooks run before validating ones, so a check that must see the final object belongs in a validating webhook. Here is the order and why.
Oct 18, 20263 min read
Security Guides
More code review approvals, more security? Myth vs fact
Requiring three approvals sounds safer. Evidence from delivery research and review guidance suggests it often makes reviews worse. Myth vs fact.
Oct 18, 20263 min read
Security Guides
Multi-stage builds: how they shrink a container's attack surface
A multi-stage Dockerfile builds in one stage and ships only the result from another. Here is what that removes, what it does not, and a working example.
Oct 18, 20264 min read
Security Guides
MTA-STS and TLS-RPT explained: enforcing TLS for inbound mail
MTA-STS lets a domain require authenticated TLS for inbound mail, and TLS-RPT reports failures. See how they work, the three modes and a safe rollout.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.