Security Guides
Which triggers in a copied workflow need a second look?
Most CI templates use push and pull_request. Triggers like pull_request_target and workflow_run run with more privilege and need care when copied.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Which trace attributes are safe: user ID, tenant, email or session?
Opaque IDs help investigations, but emails, tokens and session values do not belong in traces. A table of common attributes to record and to avoid.
Oct 19, 20263 min read
Security Guides
Which TLS versions should your app support in 2026?
Default to TLS 1.3, keep 1.2 for compatibility if needed, and turn off 1.0, 1.1 and SSL. What changed in 1.3 and how to handle old clients safely.
Oct 19, 20263 min read
Security Guides
Which three repositories should you bring to a scanner demo?
Bring three of your own repositories to a vulnerability scanner demo: a typical service, your messiest legacy repo, and one you already know well.
Oct 19, 20264 min read
Security Guides
Which supported versions of your product does an advisory affect?
Decide which supported releases an advisory affects: test SBOM versions against the range, check backports, then message each support cohort differently.
Oct 19, 20263 min read
Security Guides
Which Apache Spark ports should never face the internet?
Spark's security docs list the ports for UIs, the standalone master, REST submission and the history server. Restrict all of them to hosts that need them.
Oct 19, 20263 min read
Security Guides
Which Slack scopes should your bot request? Start with fewer
Request only the bot scopes your features need, use user scopes only when acting for a person, and remember that scopes add up across installs.
Oct 19, 20264 min read
Security Guides
Which shared libraries need stricter rules? Auth, crypto, logging
Not every shared library carries the same risk. Tier them, and apply two reviewers and faster fixes to auth, crypto and input handling libraries.
Oct 19, 20263 min read
Security Guides
Which severity score is a scanner demo showing you?
CVSS, EPSS and the CISA KEV catalog answer different questions. Ask a scanner demo which signals it shows and how they combine into a priority order.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.