Security Guides
Is the H2 console safe to enable in a Spring Boot production app?
No. Spring Boot documents the H2 console as development only, and it has no CSRF protection. How it gets enabled and how to check production.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Is Docker privileged mode safe on CI runners?
Usually no. Privileged containers carry the host's root capabilities. GitLab's runner docs explain the risk and what to do if Docker builds need it.
Oct 19, 20264 min read
Security Guides
Is dependency scanning alone enough for a small web app?
Dependency scanning covers code you imported, not code you wrote. Here is what it catches, what it misses, and when a small web app needs a second method.
Oct 19, 20264 min read
Security Guides
Is deleting old container images a security control? Myth vs fact
Image cleanup shrinks what can be pulled, but it does not patch anything running. Six myths and facts about retention as a security measure.
Oct 19, 20263 min read
Security Guides
Is Debian 11 Bullseye end of life? LTS and ELTS dates explained
Debian 11 Bullseye is listed with regular support ended in 2024 and LTS ending 31 August 2026. What the dates mean for images and inventories.
Oct 19, 20264 min read
Security Guides
Is the count of critical vulnerabilities a good executive metric?
A raw critical count is easy to read but weak on its own. What it misses, what CVSS says about itself, and what to show beside it for a fair picture.
Oct 19, 20263 min read
Security Guides
Is comparing the JWT user ID to the path ID enough to stop BOLA?
No. OWASP says comparing the session user ID with an ID parameter fixes only a small subset of broken object level authorization. What to check instead.
Oct 19, 20264 min read
Security Guides
Is catalog-info.yaml trusted input for your Backstage catalog?
The catalog continuously ingests entity descriptors from configured sources. Anyone who can write to those sources can shape what the portal shows.
Oct 19, 20264 min read
Security Guides
Is Backstage secure by default? What to lock down first
Backstage endpoints are not protected by default and all actions are open to anyone. Configure sign-in, permissions and the public entry point first.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.