Security Guides
How passkeys work and why they resist phishing
A passkey is a key pair tied to one site, so a fake login page gets nothing to steal. Here is how WebAuthn passkeys work and where their limits are.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How often should you rotate encryption keys? Cryptoperiods
Rotation schedules depend on key type and usage volume, not one magic number. Typical cryptoperiods from OWASP guidance and how to set your own.
Oct 18, 20263 min read
Security Guides
How often should you run security awareness training?
Annual training is a floor, not a plan. A practical cadence for onboarding, reminders, role sessions and exercises, and what guidance says about frequency.
Oct 18, 20263 min read
Security Guides
How much sprint capacity to reserve for security work
There is no magic percentage. Start with a small reserved slice, split it by purpose, and adjust each quarter from what the work actually cost.
Oct 18, 20263 min read
Security Guides
How many pages per on-call shift is too many?
Google's SRE guidance caps a sustainable shift at about two incidents per 12 hours. How to measure your own pager load and what to do when it runs hot.
Oct 18, 20263 min read
Security Guides
How long should a remote session last? Idle and absolute timeouts
Idle and absolute timeouts for remote dev and admin sessions, with numbers from OWASP and NIST, and how to balance security against annoyance.
Oct 18, 20264 min read
Security Guides
Hot, warm and cold log tiers: planning security log retention
Tier logs by age and value: fast search for recent events, cheaper storage for older ones, archive for the long tail. How to set periods without guessing.
Oct 18, 20263 min read
Security Guides
Cookie name prefixes explained: Host and Secure
The Host and Secure cookie prefixes make browsers enforce Secure, Path and Domain rules. What each requires, why it helps and how to adopt it safely.
Oct 18, 20264 min read
Security Guides
Home router security checklist for remote developers
A practical home router checklist for people who work remotely: admin password, WPA3, firmware, WPS, UPnP and remote management, drawn from CISA guidance.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.