Security Guides
Using CODEOWNERS to protect GitHub workflow files
How to use a CODEOWNERS file so changes to workflows need approval from a named reviewer, plus syntax traps like last match wins and skipped lines.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What reviewers should look for, and where security fits in
A walk through the review concerns in a published engineering guide, design to tests to comments, and the security questions you can attach to each one.
Oct 18, 20263 min read
Security Guides
Why you cannot put a CNAME at the zone apex, and what to do
A CNAME says no other data should exist at a name, but a zone apex needs SOA and NS records. Why that conflict breaks DNS and the practical ways around it.
Oct 18, 20263 min read
Security Guides
CloudTrail event history vs a trail: why 90 days is not enough
CloudTrail event history keeps 90 days of management events per Region. Learn what it misses and why you also need a trail or event data store.
Oct 18, 20263 min read
Security Guides
CloudFormation stack policy vs IAM: what each one controls
A CloudFormation stack policy guards resources from accidental updates, but it is not access control. How it differs from IAM and when to use both.
Oct 18, 20263 min read
Security Guides
CloudFormation dynamic references: keep secrets out of templates
Use CloudFormation dynamic references to pull secrets from Secrets Manager or Parameter Store instead of embedding them. Syntax limits and traps to avoid.
Oct 18, 20263 min read
Security Guides
CloudFormation drift detection: what it can and cannot see
CloudFormation drift detection compares live resources with the template but skips unsupported resources, defaults, nested stacks and some properties.
Oct 18, 20263 min read
Security Guides
CloudFormation DeletionPolicy: Retain, Snapshot or Delete?
How to choose between Delete, Retain, RetainExceptOnCreate and Snapshot for CloudFormation resources, including defaults and a trap with replacements.
Oct 18, 20263 min read
Security Guides
Cloud Run allow unauthenticated: when is it acceptable?
Cloud Run services are private by default. Allowing unauthenticated calls makes sense for public sites and almost nothing else. Here is how to decide.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.