Application Security
How do you build a DevSecOps culture that sticks?
DevSecOps culture is shared ownership of security results, not a tool rollout. Start with one measurable pain, give fast feedback, fix incentives.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
How does a buffer overflow happen, and how do you analyze and prevent one?
A buffer overflow writes past allocated memory and can crash a program or run attacker code. See the root causes, how to review for them and what helps.
Oct 18, 20265 min read
Application Security
How should a small business secure its web browsers?
Browsers are where staff sign in to email and cloud apps. A small business can cut risk with MFA, updates, passkeys and extension control. Start here.
Oct 18, 20264 min read
Application Security
What is broken authentication (OWASP API2:2023) and how do you fix it?
API2:2023 Broken Authentication covers weak login, token and reset flows. Rate limit every credential path, validate tokens fully and re-authenticate.
Oct 18, 20264 min read
Application Security
What is BOLA and how do you stop it in your API?
BOLA lets a signed-in user read or change another user's record by swapping an ID. Learn why scanners miss it and the per-object checks that stop it.
Oct 18, 20265 min read
Application Security
What is blue-green deployment and when does it fall short?
Blue-green deployment runs two production environments and switches traffic between them for fast rollback. Shared databases and secrets are hard.
Oct 18, 20264 min read
Application Security
How should Bitbucket Pipelines handle secrets and cloud credentials?
Use secured variables for secrets you must store, and OpenID Connect so deploys need no stored cloud keys. Learn the variable scopes and what to check.
Oct 18, 20264 min read
Application Security
Can a pull request steal secrets from Bitbucket Pipelines?
A pull request build runs code its author chose. Keep deploy credentials out of PR pipelines, scope variables by deployment, and prefer OIDC to keys.
Oct 18, 20264 min read
Application Security
What are the best practices for defeating automated attacks on web apps?
Automated attacks abuse legitimate features at scale. Use OWASP automated threats to find yours, then layer rate limits, strong auth and monitoring.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.