Security Guides
How to set a default deny NetworkPolicy in Kubernetes
Pods accept all traffic until a policy selects them. Add a default deny per namespace, then allow only what each app needs. Includes YAML and pitfalls.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
A starter Kubernetes audit policy: what to log and at what level
Kubernetes logs nothing until you pass an audit policy. Four levels, first-match order and a starter policy that keeps Secret bodies out of the log.
Oct 18, 20263 min read
Security Guides
How a Kubernetes API request is checked: authn, authz, admission
Every API request passes TLS, authentication, authorization and admission before storage. Knowing which stage returns which error saves hours of debugging.
Oct 18, 20263 min read
Security Guides
Kubelet API defaults: anonymous requests and AlwaysAllow explained
The Kubernetes docs say unrejected kubelet requests are anonymous and the default authorization mode is AlwaysAllow. Check your nodes and lock it down.
Oct 18, 20263 min read
Security Guides
Kill switch flags: designing a safe off button for incidents
A kill switch lets operators degrade or disable a feature fast during an incident. Design who can flip it, what the safe default is, and how you test it.
Oct 18, 20263 min read
Security Guides
How a license plate could unlock a Kia: the dealer API lesson
Researchers showed a license plate could be enough to take over a connected Kia through a dealer portal API. What the case teaches about backend trust.
Oct 18, 20263 min read
Security Guides
Cryptographic erasure: when destroying a key really deletes data
Deleting a key can make data unreadable, but only if every copy of the key is gone. OWASP's conditions for cryptographic erasure and key destruction.
Oct 18, 20263 min read
Security Guides
What a key compromise recovery plan should contain
A one page plan for a leaked encryption or signing key: contacts, the re-key method, key inventory, revocation and monitoring, based on OWASP guidance.
Oct 18, 20263 min read
Security Guides
Key backup and escrow: which keys to keep copies of, and which never
Lost encryption keys mean lost data, but extra copies widen risk. What OWASP says to back up, how to protect backups, and why signing keys are never escrowed.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.