DevSecOps
Securing Secrets and Environment Variables in GitHub Actions
A tag-pinned GitHub Action used by 23,000+ repos was rewritten to dump CI memory in March 2025 — here's how OIDC and SHA-pinning would have stopped it.
Jul 15, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCloud Security
Security metrics and KPIs that actually indicate cloud program maturity
IBM's 2024 breach data puts the average breach lifecycle at 258 days — most cloud security dashboards can't even tell you your own exposure window.
Jul 15, 20267 min read
DevSecOps
A framework for consolidating SAST, DAST, and SCA tools
Enterprises run 45 security tools on average, and 50+ tool stacks detect incidents 8% worse. Here's when AppSec consolidation actually pays off.
Jul 15, 20266 min read
Vulnerability Management
CVE-2022-31692: how a forward dispatch bypassed Spring Security authorization
A CVSS 9.8 flaw let a single internal forward skip Spring Security's URL-based access checks entirely — here's the root cause and the exact config fix.
Jul 15, 20266 min read
Kubernetes Security
TLS termination and cert-manager: a hardening guide for Kubernetes Ingress
IngressNightmare's CVSS 9.8 RCE showed that ingress-nginx's own admission webhook can be turned against cluster Secrets — here's how to configure TLS safely.
Jul 15, 20267 min read
Product
Introducing Safeguard Academy: Free Courses and Certifications for Supply Chain Security
We're launching Safeguard Academy — a free learning platform at academy.safeguard.sh with curated courses, an AI tutor in every course, course communities, live sessions, and publicly verifiable certifications. The first credential is the Safeguard Certified Practitioner.
Jul 14, 20265 min read
Supply Chain Attacks
Anatomy of a malicious npm package attack
One phished maintainer, 18 packages, and billions of weekly downloads — how npm/PyPI supply chain attacks actually unfold, and the signals that expose them.
Jul 14, 20266 min read
Best Practices
AppSec anti-patterns to eliminate
23.8M secrets leaked on public GitHub in 2024 alone. Here are the AppSec anti-patterns behind numbers like that — and the concrete practices that replace them.
Jul 14, 20266 min read
Cloud Security
Common AWS IAM privilege-escalation paths and how to design least privilege
Rhino Security Labs cataloged 21 distinct AWS IAM privilege-escalation methods in 2018 — most still work today, and most are invisible to a manifest scan.
Jul 14, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.