DUBLIN, California, October 10, 2026. Safeguard has signed the US Cybersecurity and Infrastructure Security Agency's Secure by Design Pledge and now appears on CISA's list of pledge signers as Safeguard.sh. By signing, Safeguard commits to showing measurable progress within one year on the pledge's seven security goals for its own products.
CISA's list of Secure by Design Pledge signers, captured October 10, 2026. Source: cisa.gov.
Interactive demo: click through CISA's signers list to Safeguard's entry, then the sign-in and account security controls Safeguard customers can use today. The Safeguard part uses a sample workspace with test data only.
The pledge, which CISA launched in May 2024, asks software manufacturers to work on seven areas: multi-factor authentication, default passwords, reducing entire classes of vulnerability, security patches, vulnerability disclosure policies, CVE transparency, and evidence of intrusions. It is voluntary, and CISA states that it does not verify adherence or endorse any signer.
Where Safeguard starts
Safeguard has published its position on each goal, including what is not done yet, in a post on its blog: We signed CISA's Secure by Design Pledge. Here is where we stand on each goal. Among the measures already in place:
- Sign-in. Users can turn on authenticator-app MFA, and organizations can sign in through their own identity provider over SAML or OIDC.
- No shared default passwords in the products customers install. The first administrator of every workspace sets their own credentials.
- Memory-safe languages across the platform, with no hand-written C or C++.
- Patches without customer action for the SaaS platform, which updates every customer as soon as a fix passes the release gate.
- A published vulnerability disclosure policy with a safe-harbour commitment for good-faith research, linked from the site's security.txt.
- A security activity log in every workspace that records sign-ins, failed sign-ins, writes, exports and refused requests, hash-chained and kept for 400 days.
What comes next
Over the next twelve months Safeguard has committed to adding native passkey sign-in, letting workspace admins enforce MFA and SSO for every user, driving down cross-site scripting and server-side request forgery as vulnerability classes, offering automatic updates for its CLI and desktop app, publishing CVEs with CWE and CPE fields for any vulnerability in its own products, and adding activity-log export and SIEM streaming. The company will publish a progress update on each goal before the first anniversary of signing.
About Safeguard
Safeguard is an AI-native software supply chain security platform. It maintains a registry of curated zero-CVE components across ten ecosystems, discovers Zero Days through reachability and taint analysis deep in the dependency tree, and authors remediation directly against the affected code. Safeguard is headquartered in Dublin, California. Pricing is public and self-serve from $0 at https://safeguard.sh/pricing.
Safeguard's inclusion on CISA's list of Secure by Design Pledge signers does not constitute an endorsement by CISA or the US Government of Safeguard or its products.
