Security Guides
What happens if you ignore dependency updates for a year?
Ignoring dependency updates for a year does not break things on day one. It builds security exposure, upgrade risk and rework. Here is what changes.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What is token binding, and what do APIs use instead today?
Token binding tied tokens to a TLS connection to stop replay. Why browser support was lacking and which sender constrained options APIs use today.
Oct 19, 20265 min read
Security Guides
What goes in a security advisory after you fix a reported bug?
The parts of a good vendor security advisory: summary, affected and fixed versions, caveats, workarounds, CVE ID, timeline and credit, in plain order.
Oct 19, 20264 min read
Security Guides
What goes in a dependency risk packet for hospital security reviewers?
A checklist of what a healthcare software vendor can assemble once: inventory, scanning, response and ownership, to speed up hospital reviews.
Oct 19, 20264 min read
Security Guides
What does GitHub secret scanning cover, and what is left to you?
GitHub secret scanning covers git history, issues, PRs, discussions, wikis, and gists. Workflow logs are not listed. Gaps and how to cover them.
Oct 19, 20264 min read
Security Guides
What can GitHub Actions secret masking not hide in logs?
Masking matches exact strings on the runner. Encoded, transformed or structured secrets can slip through. What to do about it, with a short checklist.
Oct 19, 20264 min read
Security Guides
What fields should a vulnerability finding contain?
A useful finding names the component, version, advisory ID, location, severity, exploit signals, fix version and owner. See why each field matters.
Oct 19, 20264 min read
Security Guides
What fields should a risk acceptance ticket have?
A risk acceptance ticket needs the finding, reason, compensating controls, approver, expiry and a review trigger. A field list you can copy.
Oct 19, 20263 min read
Security Guides
What fields belong on an approved software list?
An approved software list works when each entry has an owner, version rule, data class, review date and expiry. The fields to record, with an example.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.