Security Guides
How to write a chaos hypothesis for a security control
A chaos experiment starts with a testable hypothesis. How to define steady state and write one for a security control such as a WAF, token check or gate.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How to write a risk scenario that can actually be scored
Vague risks like 'data breach' cannot be rated. Use a simple sentence pattern with asset, threat, weakness and consequence so scoring becomes possible.
Oct 18, 20263 min read
Security Guides
How to write a vulnerability report a security team can act on
A researcher's checklist for a vulnerability report that gets triaged fast: steps, requests, impact, privacy and a clear disclosure timeline.
Oct 18, 20263 min read
Security Guides
WSL 2 isolation: what a Linux distro shares with your Windows host
WSL 2 runs distros as isolated containers inside a lightweight VM. Microsoft documents what they share and what they keep apart. Here is how to read it.
Oct 18, 20263 min read
Security Guides
Cross-site scripting lab: teaching output encoding by context
A lab plan for teaching XSS defense: encode for the exact output context, prefer safe sinks, and learn which framework escape hatches reopen the hole.
Oct 18, 20263 min read
Security Guides
XXE prevention checklist: disable DTDs in your XML parsers
The core XXE fix is to disable DTDs in every XML parser. Use this checklist for Java, .NET, Python and PHP, plus the places teams forget to harden.
Oct 18, 20263 min read
Security Guides
Were you ever exposed to the xz backdoor? A short audit checklist
How to work out whether any host, image or build ever ran xz 5.6.0 or 5.6.1, and what to record so the next library incident takes minutes.
Oct 18, 20263 min read
Security Guides
YARA rules basics: structure, strings and conditions
A YARA rule names a pattern and a condition that decides a match. See the rule structure, the three string types and a safe way to test your first rule.
Oct 18, 20264 min read
Security Guides
YARA vs Sigma: which rule format for which job
YARA matches patterns in files and memory, Sigma describes events in logs. This guide shows what each is for and when a team needs one, the other, or both.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.