Security
Gray Box Testing Explained: A Security Guide
Gray box testing gives a tester partial internal knowledge, splitting the difference between black box and white box. Here is when it finds bugs the other two miss.
Apr 24, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity
What Is Linting in Code? A Security Perspective
Linting is automated static analysis that catches bugs, style issues, and security anti-patterns before code runs. Here is what it does and where it fits in a secure pipeline.
Apr 24, 20265 min read
Security
Statische Code-Analyse: Sicherheitsluecken finden, bevor Code laeuft
Statische Code-Analyse prueft Quellcode ohne ihn auszufuehren und findet Sicherheitsluecken frueh. So funktioniert sie und welche Tools sich lohnen.
Apr 24, 20265 min read
DevSecOps
Git Checkout Dev: Switching to a Development Branch Safely
git checkout dev switches your working tree to the dev branch, but the safe workflow around it matters more than the command. Here is how to do it without losing work or leaking secrets.
Apr 24, 20265 min read
Containers
Docker Privileged Containers: `docker run` and Compose Risks
docker run privileged and docker compose privileged both hand a container root-equivalent access to the host — here's exactly what that means and when, if ever, it's justified.
Apr 24, 20265 min read
AppSec
Web Application Penetration Testing: What to Expect
A real web application penetration test follows a scoped, multi-phase process — here's what happens before, during, and after the engagement so the report doesn't surprise you.
Apr 24, 20265 min read
Security
Trivy Action: How to Use It in CI Without Getting Burned
The Trivy Action runs Aqua Security's scanner inside GitHub Actions. Here is how to wire it up, and why aquasecurity/trivy-action@master is the wrong way to pin it.
Apr 24, 20265 min read
Open Source
Puppeteer on npm: A Security Review and Safe Usage Guide
puppeteer npm installs a library that drives a real headless Chrome. That power brings real risks — install scripts, SSRF, and a browser-sized attack surface. Here is how to use it safely.
Apr 24, 20267 min read
Open Source
tough-cookie npm: Security Review and Safe Usage
A security review of the tough-cookie npm package, including the CVE-2023-26136 prototype pollution flaw, the version that fixes it, and how to use it safely.
Apr 24, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.