Infrastructure Security
Applying least privilege IAM in cloud-native environments
Least privilege IAM fails in practice because permissions are granted for convenience and rarely revoked. Here's how to fix that at cloud scale.
Jun 15, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIndustry
CNCF Supply Chain Security Best Practices v2: What Changed
CNCF TAG Security shipped the v2 Supply Chain Security paper in 2025, mainstreaming SBOMs, signed attestations, and zero-trust workload identity. We walk through the practical guidance.
Jun 15, 20267 min read
Industry Analysis
Application Security Strategy for 2026: AI, DevSecOps, an...
AppSec platform consolidation is reshaping 2026 strategy. See how it compares to Veracode's approach and where Safeguard fits in a unified DevSecOps stack.
Jun 15, 20267 min read
Security
Black Duck and Synopsys: What the Spinoff Means for SCA
Black Duck is now an independent company after splitting from Synopsys in 2024. Here is what changed, and what it means if you rely on it for SCA.
Jun 15, 20265 min read
Tools
CodeQL 2.22 Security Query Pack Review
GitHub's CodeQL 2.22.4 runs 478 security queries by default across 169 CWEs. We map the new queries added in 2025 and benchmark scan times on real repos.
Jun 15, 20266 min read
Infrastructure Security
Securing managed Kubernetes clusters with IaC scanning
IaC scanning catches Kubernetes RBAC, network, and IAM misconfigurations in Terraform and Helm before they ever reach EKS, GKE, or AKS clusters.
Jun 15, 20267 min read
Vulnerability Management
Reachability-based vulnerability prioritization (Polaris ...
Reachability analysis cuts CVE noise by confirming which vulnerabilities are exploitable. Here's how Black Duck's Polaris reachability compares to Safeguard's pipeline-native approach.
Jun 15, 20268 min read
AppSec
Checkmarx DAST: What It Does and How It Fits an AppSec Program
Checkmarx DAST is the dynamic testing component of the Checkmarx One platform, scanning running web apps and APIs for vulnerabilities. Here is how it works and where it fits.
Jun 15, 20266 min read
Open Source
mobx-react-lite: A Security and Dependency Guide
mobx-react-lite is the lightweight MobX binding for React function components. It is a small, focused dependency, and that shape has real implications for how you keep it safe.
Jun 15, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.