Security Guides
How do you reconstruct what an AI agent did from its logs?
Rebuild an AI agent's actions from logs by joining identity, tool calls, approvals and downstream records into one timeline. Steps and gaps to expect.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Rebuild, patch or replace: what to do with each container finding
A decision guide for container scan findings: when to rebuild on a fresh base, change your own layer, swap the base image or record an exception.
Oct 19, 20264 min read
Security Guides
How do you keep rarely deployed services from running stale images?
Services that rarely change still run old base images. A scheduled no code rebuild, a smoke test and a clear owner keep them current without feature work.
Oct 19, 20264 min read
Security Guides
How do you rebuild branch protection for a new monorepo?
A new monorepo has none of the old repos' branch rules. Rebuild them: required reviews, code owner approval, unique check names, and a CODEOWNERS owner.
Oct 19, 20264 min read
Security Guides
What if real customer data was committed to a test fixture in git?
If real customer records landed in a git fixture, contain it, rewrite history, clean every clone and fork, rotate secrets and note it. A step by step plan.
Oct 19, 20264 min read
Security Guides
How do I read an SBOM someone sent me in five minutes?
A five minute triage for a vendor SBOM: check the format, who made it, when, what it describes, and whether the dependency data is complete, in that order.
Oct 19, 20264 min read
Security Guides
What should an open source scanner's security policy tell you?
Before you trust a scanner, read how its own maintainers handle vulnerability reports. Here is what a good SECURITY.md contains and what gaps to flag.
Oct 19, 20263 min read
Security Guides
Reachable or total open vulnerabilities: which number do you report?
Report both: total open findings for completeness and the reachable subset for priority. How to define reachable, label it honestly, and avoid hiding risk.
Oct 19, 20263 min read
Security Guides
Reachable or total vulnerabilities: which count should you report?
Report both, labelled. Total counts show inventory exposure, reachable counts show code paths that can run. Learn how to present them and check the data.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.