Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A seven item checklist to run before any registry retention rule goes live: preview results, deployed images, digests, multi-arch, evidence and rollback.
List every registry, organisation and publishing token your company depends on, name an owner and a backup, and replace long-lived tokens where you can.
Docker Registry Access Management limits Desktop pulls to approved registries at hostname level. Its documented gaps mean you still need checks in CI.
Evidence often carries names, hostnames and keys. A redaction checklist, a two person check and a way to keep the original before anything is sent.
Redact at the source first so secrets never leave the process, then add a pipeline filter as a backstop. A comparison of both with steps to set up each.
Red Hat publishes CSAF and VEX documents, OSV records, SBOMs, OVAL and an RSS feed. A decision guide for choosing the right one for scanning or alerts.
Scripted data, no evidence trail, no failure case, and vague limits are common red flags in a security AI demo. Here is what to watch for and what to ask.
Set red, amber and green lines from your baseline and policy, not from guesses. A method for choosing thresholds that teams accept and leaders can enforce.
When you dismiss an SCA finding, record the reason category, evidence, owner and review date. A template and examples that survive an audit and a handover.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
