Security Guides
How do you match security testing depth to an app's risk?
Sort apps into three risk tiers, then give each tier a fixed testing baseline. A table, a scoring step and a review rhythm you can adopt this week.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What do you do with acquired code that cannot meet your dependency policy?
Some acquired code cannot meet your dependency policy soon. Ring fence it: isolate, limit access, add compensating controls, set a retirement date.
Oct 19, 20264 min read
Security Guides
How to revoke GitHub access after losing a laptop, step by step
Lost a laptop signed in to GitHub? Revoke sessions, SSH keys, personal access tokens and OAuth apps in this order. Steps and what each one cuts off.
Oct 19, 20264 min read
Security Guides
How do you revoke a customer's access to your security evidence?
Revoking customer access to SBOMs and security reports takes a short offboarding checklist: list who has access, remove it, expire links, and log the date.
Oct 19, 20264 min read
Security Guides
How to revoke AWS sessions after a lost laptop, step by step
A lost laptop can hold live AWS credentials. Revoke role sessions, sign out of Identity Center and rotate keys. Steps, trade offs and what to check.
Oct 19, 20264 min read
Security Guides
Reviewer checklist: OS patch ticket versus dependency pull request
What an approver should check before saying yes to an OS patch change or a dependency update PR. Two short checklists with the reasons behind each item.
Oct 19, 20263 min read
Security Guides
How do you review your security testing mix each year?
A yearly review keeps your testing mix aligned with what you ship. Eight checks: coverage, noise, ownership, inputs, incidents, gaps, evidence and effort.
Oct 19, 20264 min read
Security Guides
Do you need a postmortem when a vendor's incident hit you?
Yes, a short one about your own response. Review how fast you learned, how you assessed exposure and how you communicated, not the vendor's cause.
Oct 19, 20263 min read
Security Guides
How do you spot a security check that a pull request quietly removes?
Reviewers read added lines and skim deleted ones, but a removed check is a regression. How to find deleted authorization, validation and logging in a diff.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.