Security Guides
What does a Scrum Master do for security on a team?
A Scrum Master does not own security, but protects the conditions for it: a real definition of done, removed blockers, and events that make room for it.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What does a red, amber, green security status hide?
RAG colours compress a lot of detail into three states. Learn what they hide, how thresholds get gamed and how to make the colours honest and useful.
Oct 19, 20263 min read
Security Guides
What does a product owner own in secure software development?
The product owner decides what is built and in what order, so they own the trade-offs between features and security work. Here is what that covers.
Oct 19, 20264 min read
Security Guides
What does a policy gate read from scan output?
A policy gate reads scan fields such as severity, exploit status, reachability and fix availability, then passes, warns or blocks. See the rules.
Oct 19, 20264 min read
Security Guides
What does a Play Integrity verdict tell your API server?
Play Integrity tells your backend if a request came from your genuine app on a certified Android device. What each verdict means and how to roll it out.
Oct 19, 20264 min read
Security Guides
What does a GitHub Actions OIDC sub claim look like?
The sub claim in a GitHub Actions OIDC token names the repo plus a branch, environment or pull request. See each format and how to pin a cloud role to it.
Oct 19, 20264 min read
Security Guides
What does a CVSS score of 9.8 mean to an executive?
A critical CVSS score says how severe a flaw is in the abstract. It does not say your risk. How to explain the difference to executives in plain words.
Oct 19, 20264 min read
Security Guides
What do GHSA, CVE, DSA and DEBIAN prefixes tell you in a scan?
The prefix on an advisory ID names the database that issued it. Learn what GHSA, CVE, DSA and DEBIAN mean and how to use them when reading scan findings.
Oct 19, 20264 min read
Security Guides
What do the SSVC decisions Track, Attend and Act mean?
CISA's SSVC tree sorts vulnerabilities into Track, Track star, Attend and Act. See what each decision asks of your team and how to adapt it for ops.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.