DevSecOps
GitLab CI Supply Chain Hardening Checklist 2026
A 2026 hardening checklist for GitLab CI: ID tokens, protected branches, runner isolation, included templates, and the controls that actually shrink blast radius.
Mar 19, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Container Security Scanning: A Practical Guide
What a container security scan checks for, where it fits in your pipeline, and how to turn a wall of image CVEs into a short list of things worth fixing.
Mar 19, 20266 min read
AI Security
MCP Server Authorization Patterns in 2026
The Model Context Protocol shifted agent integration from custom glue to a standard surface. Authorization patterns that work, and the ones that keep biting teams.
Mar 19, 20266 min read
Tools
Falco 0.40: Modern eBPF Is Now Default
Falco's 0.40 release line makes modern eBPF (CO-RE) the default driver, deprecates the legacy probe and gVisor engine, and changes how operators ship Falco. Here's what changed and what to test.
Mar 19, 20266 min read
AI Security
Container Security Best Practices That Actually Reduce Risk
Container security best practices come down to a small set of high-leverage habits: minimal images, non-root users, scanned dependencies, and least-privilege runtime. Here is the working list.
Mar 19, 20266 min read
Best Practices
Best Container Image Scanners 2026
A fact-based review of the best container image scanners in 2026, comparing Trivy, Grype, Snyk, Prisma Cloud, and Safeguard on accuracy and noise.
Mar 19, 20267 min read
AI Security
Docker and Containers: A Practical Security Guide
Docker and containers share the host kernel, so their security model is different from virtual machines. Here is how to build, run, and scan containers safely.
Mar 19, 20267 min read
Incident Analysis
PyPI Trusted Publishing Token Leaks in 2025
Trusted Publishing made PyPI safer, but leaked short-lived OIDC tokens in CI logs kicked off a credential-replay campaign that PyPI, GitHub, and Sonatype all tracked in 2025.
Mar 19, 20268 min read
Comparisons
Veracode vs Snyk: A Practical Comparison
Veracode and Snyk both cover SAST and SCA, but they come from opposite starting points — Veracode from centralized, policy-driven enterprise scanning, Snyk from developer-first IDE and git integration.
Mar 19, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.