Security Guides
Safeguard articles tagged "Security Guides" — guides, analysis, and best practices for software supply chain and application security.
100 articles
What are zombie connections in low-code tools and how do you retire them?
Zombie connections are old, broad, long-lived credentials left in low-code platforms. Learn how they form and a safe way to find and retire them.
How does zero trust apply to legacy systems that cannot change?
Zero trust shifts protection from network location to each resource. For legacy systems, that means a gate in front of each one, not trust in the segment.
Your payment provider is down. How should checkout behave?
Fail clearly, never guess. Stop new charge attempts, keep carts, queue safe actions, reconcile with the provider afterwards, and tell customers plainly.
Your fix will miss the promised date: how do you tell the researcher?
Tell the researcher early, explain why, give a new date and offer interim mitigation. A vendor's guide to resetting a disclosure timeline honestly.
What to put in an SBOM folder before your first enterprise review
Before a first enterprise security review, a startup should keep a small SBOM folder ready: a sample, a process note, and a vulnerability response page.
My dependency has a CVE: must my library publish an advisory?
When a dependency has a CVE, decide: affected, not affected, or unsure. Only affected cases need your own advisory. Decision steps for maintainers.
You loaded an untrusted pickle model. What do you do in the first hour?
Loading a malicious pickle can run code as your user. Steps for the first hour: isolate, preserve, rotate credentials, check egress, and rebuild.
You inherited a repo with no lockfile: what to do first?
No lockfile means every install can resolve different versions. Learn how to generate one safely, review the first diff, and make it stick in CI.
Which XSS sinks should you review in React, Vue and Angular?
One table of the escape hatches to search for in React, Vue and Angular code, what each does, and how to review it. Use it as a pull request checklist.
Should you still send X-XSS-Protection and Expect-CT headers?
X-XSS-Protection and Expect-CT are obsolete. See why a strict CSP replaces the first, why Chromium deprecated the second, and what value to send if needed.
What does X-Content-Type-Options: nosniff actually block?
nosniff makes browsers trust your Content-Type and block scripts and styles with the wrong MIME type. See the two effects, the upload risk and a test.
An advisory lists the wrong affected versions: how to fix it
When a scanner is wrong because the advisory data is wrong, fix the record, not just your ignore list. How to propose a correction to a public advisory.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.