Security Guides
What counts as remediated: fixed, mitigated or risk accepted?
Fixed, mitigated, accepted and false positive are four different closures. Count them separately so remediation metrics do not mislead anyone.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What counts as patched? Restart, redeploy and verify explained
A patch is done when the fixed code is running, not when it is installed or merged. See the done criteria for OS patches and dependency updates.
Oct 19, 20263 min read
Security Guides
What makes a license open source? The ten OSI criteria in plain words
A license is open source when it meets the ten criteria of the Open Source Definition. Here they are in plain words, with what each means for your product.
Oct 19, 20264 min read
Security Guides
What counts as one vulnerability in your dashboard number?
A dashboard's vulnerability count can mean CVEs, findings or affected instances. Here is how each unit works and how to pick one and label it.
Oct 19, 20264 min read
Security Guides
What controls how long a fix takes to deploy?
The deploy stage has its own clock: approvals, wait timers, rollout settings and rebuilds. Here is what controls each and how to shorten them safely.
Oct 19, 20264 min read
Security Guides
What controls should a new plugin store have on launch day?
Six controls to ship with a vendor plugin store: signing, review triggers, permission declarations, reporting, blocking and monitoring. A launch checklist.
Oct 19, 20264 min read
Security Guides
What changes when you network activate a WordPress plugin on multisite?
One network activation runs the plugin on every site in a multisite network, so one flaw reaches them all. Only Super Admins manage network plugins.
Oct 19, 20263 min read
Security Guides
What can an attacker do with a taken over subdomain?
A hijacked subdomain is more than a defaced page. See how cookie scope, trust in your domain and email records turn it into account takeover and phishing.
Oct 19, 20264 min read
Security Guides
What can an attacker do with a stolen CI secret?
A stolen CI secret can mean publishing a poisoned package, pushing code or reaching cloud accounts. See the blast radius ladder and how to shrink it.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.