Security Guides
GitLab CI_JOB_TOKEN allowlist: control cross-project access
CI_JOB_TOKEN works only while a job runs and reaches only its own project by default. How the allowlist works and which settings to leave on.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Set GITHUB_TOKEN to read-only and grant permissions per job
Why the default GITHUB_TOKEN should be read-only, how to grant write access per job with the permissions key, and what to check in older workflows.
Oct 18, 20263 min read
Security Guides
GitHub push protection: setting a sane bypass policy
Push protection blocks secrets before they land, but anyone with write access can bypass it by default. How to set bypass reasons and delegated review.
Oct 18, 20263 min read
Security Guides
Turn on GitHub private vulnerability reporting: steps and form
Maintainers can enable private vulnerability reporting in a few clicks so researchers have a private channel. Steps and the custom form option.
Oct 18, 20263 min read
Security Guides
GitHub environments: required reviewers for production deploys
How environment protection rules gate production deploys in GitHub Actions: reviewers, self-review block, wait timers, branch limits and plan caveats.
Oct 18, 20263 min read
Security Guides
GitHub branch protection rules versus rulesets: which to use
Branch protection allows one rule per branch. Rulesets layer, toggle without deleting, and are visible to readers. A short guide to choosing between them.
Oct 18, 20263 min read
Security Guides
Stopping script injection in GitHub Actions workflows
How script injection works in GitHub Actions run steps and the fix GitHub recommends: pass untrusted values through an environment variable, not inline.
Oct 18, 20263 min read
Security Guides
Replace long-lived cloud secrets with GitHub Actions OIDC
How OIDC lets a GitHub Actions job get a short-lived cloud token instead of a stored key, what the subject claim does, and how to scope the trust.
Oct 18, 20263 min read
Security Guides
GitHub Actions to AWS with OIDC: no stored access keys
Use OpenID Connect so GitHub Actions gets short-lived AWS credentials. See the setup, the permissions needed and the trust policy condition to include.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.