Security Guides
Renew or re-review? Handling an expiring vulnerability exception
A renewal should be a fresh decision with fresh evidence, not a date change. A decision guide for renew, fix, narrow or let an exception lapse.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Suppress a finding or remove the dependency you plan to drop?
If a vulnerable dependency leaves soon, a short suppression tied to the removal ticket is fine. If removal is vague, suppression turns permanent.
Oct 19, 20264 min read
Security Guides
How do you run a security tabletop with a remote team?
Run a supply chain tabletop over video: tools, a shared scribe board, an out of band channel, time zone tips and how to keep quiet people involved.
Oct 19, 20264 min read
Security Guides
How do you run a remediation retrospective after a hard month?
After a surge or a missed target, a blameless retrospective finds the system causes. Get an agenda, questions to ask and the changes worth making next.
Oct 19, 20263 min read
Security Guides
What supply chain questions should you rehearse before a diligence call?
Ten supply chain questions an engineering lead should be ready to answer in two minutes each, with a note on the evidence that backs every answer.
Oct 19, 20264 min read
Security Guides
What should a registry token policy include? Lessons from npm
Scoped, expiring, read-only by default, IP limited and tied to the owner's rights: the npm token model as a checklist for your own self-hosted registry.
Oct 19, 20264 min read
Security Guides
Which TLS settings should a self-hosted registry use?
The Distribution registry defaults to TLS 1.2 minimum and supports client certificates. What minimumtls, clientcas and clientauth do, and when to use them.
Oct 19, 20263 min read
Security Guides
Can Docker registry notifications serve as an audit trail?
Registry notifications send pushes, pulls and deletes to a webhook with actor and request fields, but delivery is best effort. When to rely on them.
Oct 19, 20264 min read
Security Guides
Is the default Docker registry config safe for production?
No. The Distribution registry defaults target development: debug logging, trace export to localhost, delete off, no auth. A change list for production.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.