Security Guides
Should security fixes count toward team velocity?
Yes, count security fixes in velocity if you size them like any other story, but report them separately so planning stays honest and the work is visible.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Should secure coding training be mandatory or optional?
Make a small core of secure coding training mandatory and the deeper material opt in. Why each choice works, what to require and how to avoid resentment.
Oct 19, 20263 min read
Security Guides
Should sample code ever disable TLS certificate verification?
Samples that switch off certificate checks teach readers to ship insecure clients. Here is the safer way to handle a self-signed test certificate.
Oct 19, 20264 min read
Security Guides
Should reachability decide which vulnerabilities get automated fixes?
Using reachability to choose which findings get automated fix PRs cuts noise and risk. What it can and cannot tell you, and how to gate with it.
Oct 19, 20264 min read
Security Guides
Should pull request workflows get cloud credentials?
Pull request workflows should rarely get write access to a cloud account. Use read only roles for checks and protected environments for deploys.
Oct 19, 20264 min read
Security Guides
Should public repository pull requests run on self-hosted runners?
GitHub says self-hosted runners should almost never serve public repositories. Why untrusted pull requests make them risky and what to use instead.
Oct 19, 20263 min read
Security Guides
Should production depend on a preview or beta vendor API?
Depend on a preview API only for features you can switch off, with a stated fallback. Read the terms for change and retirement notice before you commit.
Oct 19, 20263 min read
Security Guides
Should product email use a separate sending subdomain?
Why many software companies send product and marketing mail from separate subdomains, what it isolates, and how to set DMARC, SPF and DKIM for each.
Oct 19, 20264 min read
Security Guides
Should preview deployments of a static site be public?
Preview URLs can leak unreleased content, draft pages and test keys. Decide who may open them, how long they live, and what data they may touch.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.