Security Guides
How to scope a Lambda execution role to least privilege
A Lambda execution role is what an attacker inherits if your function is compromised. Here is how to shrink it from broad to exactly what the code uses.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Lambda environment reuse: what leaks between invocations
Lambda reuses execution environments, so globals and the tmp directory can carry data between requests. Here is how to avoid cross-request leaks.
Oct 18, 20263 min read
Security Guides
Should you keep secrets in Lambda environment variables?
Lambda encrypts environment variables at rest, but AWS itself recommends a secrets service for credentials. Here is when each choice makes sense.
Oct 18, 20263 min read
Security Guides
Kubernetes authentication options compared: certs, tokens and OIDC
Client certificates cannot be revoked, static token files are clear text, and service account tokens are for workloads. Why OIDC suits human users.
Oct 18, 20263 min read
Security Guides
Why system:masters is different from cluster-admin in Kubernetes
Members of system:masters bypass all RBAC checks, so deleting a binding cannot revoke their access. Here is why that matters and what to use instead.
Oct 18, 20263 min read
Security Guides
Kubernetes service account tokens: bound, legacy and how to limit them
Pods get a short-lived projected token since v1.22. Older long-lived Secret tokens never expire. How to opt out of mounting and keep roles small.
Oct 18, 20263 min read
Security Guides
Kubernetes securityContext checklist: the settings that matter
A copy-ready pod securityContext: non-root user, no privilege escalation, read-only root filesystem, dropped capabilities and RuntimeDefault seccomp.
Oct 18, 20263 min read
Security Guides
Kubernetes Secrets checklist: what admins and developers each own
The Kubernetes docs split Secret hygiene between cluster admins and developers. A two column checklist covering encryption, RBAC, etcd, mounts and logging.
Oct 18, 20263 min read
Security Guides
Kubernetes Secrets and base64: myth vs fact
Base64 in a Secret manifest is encoding, not encryption. Five common beliefs about Kubernetes Secrets, checked against the official guidance.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.