Regulatory Compliance
SOC 2 Meets SSDF: A Practical Mapping
SOC 2 auditors are starting to ask about secure development practices. Here's how to map NIST SSDF tasks onto SOC 2 Trust Services Criteria without duplicating work.
Feb 19, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedIdentity Security
How to set up mutual TLS (mTLS) between microservices
A step-by-step guide to configuring mTLS across microservices with Istio — from CA setup and PeerAuthentication policies to certificate rotation and verification.
Feb 19, 20266 min read
Open Source Security
Single-Maintainer Bus Factor Risk in OSS
A single person maintaining critical infrastructure is one medical emergency, burnout, or coercion event away from a supply chain crisis. The bus factor is not a theoretical metric.
Feb 19, 20266 min read
Incident Analysis
Okta 2022-2023 Incidents: Supply Chain Lessons
A retrospective on Okta's string of security incidents from 2022 through 2023 and what they teach us about identity providers as critical supply chain dependencies.
Feb 19, 20266 min read
Best Practices
AWS Lambda Layers: Supply Chain Risks
Lambda layers feel like a convenience but they are a supply chain attack surface that most teams do not treat as code. Here is how they get abused and what to do about it.
Feb 18, 20267 min read
Secure Development
Node.js Permission Model: Restricting What Your Code Can Do
Node.js finally has an experimental permission model. It is a significant step toward containing supply chain attacks, but it has important limitations.
Feb 18, 20265 min read
Cloud Security
Cloud Security Posture Management: A No-Nonsense Guide
What CSPM actually does, where it falls short, and how to get real value from posture management instead of drowning in alerts.
Feb 18, 20267 min read
Risk Management
Where Technical Debt Meets Security Debt
Technical debt and security debt are deeply intertwined. Untangling them requires understanding how shortcuts in code quality create openings for attackers.
Feb 18, 20266 min read
Case Studies
GitHub's Supply Chain Security Features
A comprehensive look at GitHub's evolving supply chain security toolkit, from Dependabot to code scanning, and how these features are reshaping how developers manage dependency risk.
Feb 18, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.