Security Guides
How do I require approval before a production deploy?
Use GitHub environments with required reviewers, deployment branch rules and environment secrets. Check your plan, because private repos have limits.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do you require 2FA for new developers and contractors on GitHub?
Turn on the organization 2FA requirement. Members without it lose access, outside collaborators are removed, and the audit log records which ones.
Oct 19, 20263 min read
Security Guides
How do I require two-factor authentication for a lab GitHub organization?
Organization owners can require 2FA for members and outside collaborators. Steps, what happens to people without it, and lab specific tips.
Oct 19, 20263 min read
Security Guides
How do you reproduce a researcher's vulnerability report safely?
Reproduce a reported bug in an isolated test copy, log what you did, and ask targeted questions when it fails. A safe reproduction routine for vendors.
Oct 19, 20264 min read
Security Guides
How do you report the first monorepo scan results to leadership?
Report coverage first, then exposed risk, then a plan with dates. A one page structure for a legacy monorepo's first scan that avoids scary raw totals.
Oct 19, 20263 min read
Security Guides
How do you report a security problem in a Docker Official Image?
Open an issue in the official-images repository, or for security updates use a pull request marked security and email the team. Know what to include first.
Oct 19, 20264 min read
Security Guides
How do you report a malicious VS Code extension to the Marketplace?
Use the Report a concern link on the extension's More Info page, then remove it locally. What the Marketplace does next and what to put in your report.
Oct 19, 20264 min read
Security Guides
How should a vendor report a flaw it finds in a component it ships?
Found a flaw in a component you ship? Report it privately to the maintainer with a reproduction and timeline, and protect your customers in parallel.
Oct 19, 20263 min read
Security Guides
How do you reply when a customer asks if you are affected by a CVE?
Answer a customer's 'are you affected' email with a clear status, the evidence, your actions and when you will update them. Includes a reply template.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.