Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CSME and the AMD PSP are security processors that boot before your CPU. What they run, how OEMs ship their updates, and the version checks admins can run.
Run Nextcloud for files, calendar and contacts and Immich for photos on one encrypted Docker server, reached over WireGuard, with tested 3-2-1 backups.
DNS cache poisoning makes a resolver store a forged answer. How Kaminsky, fragmentation, SAD DNS and MaginotDNS worked, and the settings that stop them.
Java trusts a server when its TrustManager builds a PKIX path to a root in the JVM truststore, usually cacerts. How it works and how to change it safely.
Agents write search queries from their context, so names and emails leak. Redact before the call, search through your own proxy and log hashes, not text.
Autoinstall replaced preseed on Ubuntu Server 20.04. Write a YAML config, deliver it via cloud-init NoCloud, test in a VM, keep secrets out, pin versions.
From BEAST in 2011 to Raccoon in 2020, each TLS attack broke a legacy feature. TLS 1.3 removed most of them; the lessons for your servers still apply.
SPDM lets a host or BMC ask a NIC, GPU, SSD or CXL device for its certificate chain and a signed list of firmware measurements, then check both.
A phone's environmental report can show mass by material, recycled content, battery type and carbon, but never part numbers or firmware. How to read one.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
