Security Guides
Should CI job containers run as root?
Run CI job containers as a non-root user where you can. Here is what that limits, what it breaks, and how to fix the common build failures.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Should CI be able to release your mobile app to production?
CI can ship to testers on every change, but production works better behind a tag, a manual job and an approval. How to split the lanes and credentials.
Oct 19, 20264 min read
Security Guides
Should an artifact bucket use S3 versioning or Object Lock?
Versioning lets you recover overwritten build artifacts, and Object Lock makes versions undeletable for a set time. Learn when each fits a release bucket.
Oct 19, 20264 min read
Security Guides
Should an API return 403 or 404 for another tenant's object?
Both are accepted by OWASP guidance. 404 hides that a record exists, 403 is more honest. How to choose, apply it consistently and test for it.
Oct 19, 20264 min read
Security Guides
Should an AI-built prototype have an expiry date?
Yes. Give every AI-built prototype an owner and a review date, then promote or delete it. A simple expiry process that keeps stray apps from lingering.
Oct 19, 20264 min read
Security Guides
Should Airflow workers be able to reach PyPI at run time?
Some Airflow task types install packages at run time, which needs outbound access. Why that widens risk, and how to move installs to build time.
Oct 19, 20263 min read
Security Guides
Should AI-written fix PRs ever auto-merge?
Auto-merge for AI-written fixes is a late step, not a starting point. Learn the prerequisites, the narrow cases that fit, and the guardrails to set first.
Oct 19, 20264 min read
Security Guides
Should AI agent approvals and permissions expire?
Yes. Time-box agent approvals and permissions so forgotten access ends on its own. Suggested expiry by risk, and how to renew without rubber stamping.
Oct 19, 20263 min read
Security Guides
Should agency staff use MFA on every client dashboard?
Yes. One agency laptop can hold access to dozens of client sites, so MFA on hosting, registrar, repository and CMS logins is the cheapest strong control.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.