Security Guides
Authorization for web apps: a deny-by-default checklist
OWASP authorization guidance as a checklist: deny by default, least privilege, check every request, prefer attribute or relationship rules, test denial.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Authentication events to log: a login logging checklist
A checklist of authentication and session events to record, with the fields and exclusions that make them useful for detection and investigation.
Oct 18, 20263 min read
Security Guides
Authenticated DAST: a buyer checklist for login handling
Most real app flaws sit behind a login. A checklist for judging whether a dynamic scanner can sign in, stay signed in and test each user role.
Oct 18, 20263 min read
Security Guides
How to audit your Chrome extensions in five minutes
A five minute routine to review every Chrome extension you have installed: check site access, incognito, and what to remove, using only built in settings.
Oct 18, 20263 min read
Security Guides
Attack trees explained with a small worked example
An attack tree breaks one attacker goal into the ways to reach it. Build one in four steps, with an account takeover example and tips on when it helps.
Oct 18, 20264 min read
Security Guides
Attack surface reduction rules on a dev PC: audit first, then block
ASR rules block risky behaviours like obfuscated scripts and credential theft. Developers should run most in audit mode first. Here is Microsoft's rollout.
Oct 18, 20263 min read
Security Guides
Seven attack surface myths that leave gaps
Common beliefs about attack surface management that cause blind spots: from 'we know our assets' to 'smaller is always better'. Fact versus myth.
Oct 18, 20263 min read
Security Guides
How to build a detection coverage layer in ATT&CK Navigator
A step by step method for using ATT&CK Navigator layers to record which techniques you detect, which you miss, and what to fix first on the evidence.
Oct 18, 20263 min read
Security Guides
ATT&CK Enterprise, Mobile or ICS: which matrix should you use?
MITRE ATT&CK has separate matrices for enterprise, mobile and industrial control systems. A decision guide for picking the one that fits your estate.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.