Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Azure's mandatory MFA does not apply to managed identities or service principals, but it does apply to a user account running a script. A short audit to find and migrate them.
Flare found 10,456 Docker Hub images with exposed keys in November 2025, and .env files were a common cause. Check your images, fix the build, and rotate what leaked.
Kubernetes calls pod user namespaces stable since v1.36. Here is what your nodes need, the one field that turns it on, and how to prove the mapping works.
Kubernetes v1.37 adds alpha bind mount options and an emptyDir mode field. Here is how to try noexec, nosuid and a sticky bit on a test cluster.
CVE-2026-2270 turns namespace-scoped write access into a pod in another namespace. Use it as the reason to run a real RBAC audit with kubectl and jq.
Two 2026 ingress-nginx advisories turn Ingress annotations into code execution. A built-in CEL policy can block them in minutes, with no webhook to run.
When ingress-nginx code execution is the risk, outbound limits decide what an attacker can steal. A short NetworkPolicy starter with the DNS gotcha.
Debian 13.7 rebuilt many packages against a patched glibc. Use the release and Docker Hub tag dates to set a rebuild cadence for your own images.
Terraform 1.16.6 and Trivy 0.76.0 both shipped on 14 October 2026. Here is a pull request gate that scans HCL and the plan, with exceptions that expire.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
