Security Guides
Giving sudo ALL except a few commands: myth vs fact
A sudoers rule like ALL, !SU, !SHELLS looks safe but is easy to bypass. What the sudoers manual says, and what to do instead: allow lists and review.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Fork networks share Git data, even after a fork is deleted
GitHub warns that Git data in one repository of a fork network can be reached from any other in it. What that means for private commits and deleted forks.
Oct 18, 20263 min read
Security Guides
Deleting user data across regions, backups and replicas
A deletion request has to reach every region, replica, backup and index. A design for propagating deletes and explaining backup retention honestly.
Oct 18, 20263 min read
Security Guides
Deleting a Claude account: a checklist to run first
Deleting a Claude account is permanent. Export first, cancel paid plans, check shared links and third party access. The steps and the caveats.
Oct 18, 20263 min read
Security Guides
How do you limit DNS credentials for ACME DNS-01 validation?
Keep full DNS API keys off your web servers. Delegate the _acme-challenge name with a CNAME, scope credentials narrowly, or validate from a separate host.
Oct 18, 20263 min read
Security Guides
Defender tamper protection: what it locks and why admins notice
Tamper protection stops settings like real-time protection and exclusions from being changed. See what it locks and why Group Policy edits seem to fail.
Oct 18, 20264 min read
Security Guides
Defender exclusions: a checklist before you exclude a dev folder
Before excluding a build folder from Microsoft Defender Antivirus, check the exclusion type, scope, who manages it, and test it with the EICAR file.
Oct 18, 20264 min read
Security Guides
How do you deduplicate SAST and DAST findings that describe the same bug?
Match findings by CWE, location and parameter to merge SAST and DAST reports of one flaw into one ticket. A matching recipe with a worked example.
Oct 18, 20263 min read
Security Guides
What do no-dsa, postponed and ignored mean in the Debian security tracker?
Debian tracker tags such as no-dsa, postponed, ignored and unfixed tell you whether a system library fix is coming. How to read them for C library alerts.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.