DevSecOps
Gitleaks Secret Scanning Recipes for 2026
Practical Gitleaks configurations and workflows for 2026, including pre-commit setup, monorepo tuning, custom rules, and how to avoid the false-positive treadmill.
Mar 25, 20265 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Practical Gitleaks configurations and workflows for 2026, including pre-commit setup, monorepo tuning, custom rules, and how to avoid the false-positive treadmill.
CI/CD runners are a top attacker target. Here's a concrete zero-trust blueprint using OIDC federation, pinned action SHAs, and short-lived identities.
Reachability across a monorepo or a microservices fleet needs different engineering than reachability inside a single service. Both are tractable; both have specific failure modes.
Shift-left is necessary but insufficient. A program design that distributes supply chain checks across IDE, CLI, PR, build, and runtime — without redundancy.
Platform engineering teams are becoming the new home for security controls. Here's why that is both promising and risky.
How to replace periodic compliance audits with continuous, automated monitoring that catches drift before auditors do.
Security champions are the human layer that makes shift-left work. A 2026 program design for selecting, training, and retaining champions in engineering.
The first week is when developers form their habits. A template for onboarding new engineers into supply chain controls without overwhelming them.
The 2026 playbook for automated secret rotation: detection pipelines, credential broker patterns, blast-radius analysis, and CI integration that actually holds up in production.
Weekly insights on software supply chain security, delivered to your inbox.