Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
X-XSS-Protection and Expect-CT are obsolete. See why a strict CSP replaces the first, why Chromium deprecated the second, and what value to send if needed.
nosniff makes browsers trust your Content-Type and block scripts and styles with the wrong MIME type. See the two effects, the upload risk and a test.
When a scanner is wrong because the advisory data is wrong, fix the record, not just your ignore list. How to propose a correction to a public advisory.
Write AI requirements as testable statements across inventory, MCP, agent permissions, data handling and evidence. A template with examples you can adapt.
Write the pass, fail and tie rules for a scanner comparison before any results exist. It stops hindsight and the loudest voice from picking the winner.
A dependency upgrade runbook covers confirming exposure, picking a version, testing, rollout and rollback. Use this template so any engineer can run it.
Allow the SNS service to send to your SQS queue, then add an aws:SourceArn or aws:SourceAccount condition so only your topic can. Example and checks.
A good options memo states the decision needed, two or three options with trade-offs, and one clear recommendation, in one page a leader can act on.
Report a vulnerability with a clear summary, affected version, minimal reproduction, impact, and your disclosure intentions. A checklist for researchers.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
