Security Guides
A pre-deploy security checklist for a serverless function
Twelve checks to run before a serverless function goes live, drawn from AWS, Azure, Google Cloud and Cloudflare documentation, with the reason for each.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Serverless event input validation: queues, blobs and webhooks
A function triggered by a queue or storage event still receives untrusted data. Validate every trigger payload as if it came from the internet.
Oct 18, 20263 min read
Security Guides
Denial of wallet in serverless: caps that limit the bill
Serverless scales with traffic, including hostile traffic, and you pay for it. Here are the documented limits that cap runaway cost and execution.
Oct 18, 20263 min read
Security Guides
Serverless CORS: why a wildcard origin list is a mistake
A wildcard in your function's allowed origins lets any website call it from a visitor's browser. List the specific domains instead. Here is why and how.
Oct 18, 20263 min read
Security Guides
Why a security fix should not ship inside a refactor
Mixing a refactor with a security fix hides the fix, slows review and complicates rollback. How to split them and keep both changes easy to verify.
Oct 18, 20264 min read
Security Guides
Separate LLM API keys per environment and feature: a decision guide
One shared LLM key is the easiest to leak and the hardest to revoke. How to split keys by environment, feature and team without making a mess of it.
Oct 18, 20263 min read
Security Guides
API6 sensitive business flows: protecting against bots and abuse
OWASP API6:2023 is about abuse of legitimate flows, not bugs. Learn how to choose which flows to protect and which controls fit each flow best.
Oct 18, 20264 min read
Security Guides
Semi-quantitative risk scoring: 0 to 100 scales and bins
Semi-quantitative scoring sits between color labels and money models. See how NIST describes bins and scales, and when the extra detail is worth it.
Oct 18, 20263 min read
Security Guides
Self-hosted GitHub runners: security risks and safer setups
Self-hosted runners can be persistently compromised by untrusted workflow code. How they differ from hosted runners and how to reduce the risk.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.