Security Guides
Should a vendor rescore a CVE for its own product?
When to rescore a third party CVE for your product and when to use VEX instead, with what CVSS v4.0 says about Base, Threat and Environmental scores.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
Should a team share one Jupyter notebook signatures database?
Sharing the Jupyter signatures database avoids re-trusting every notebook, but it widens who can mark outputs as trusted. How to decide for a team.
Oct 19, 20264 min read
Security Guides
Should a small team use self-hosted CI runners?
Most small teams should stay on hosted runners. Self-hosted runners keep state between jobs and trust whoever can open a pull request. How to decide.
Oct 19, 20264 min read
Security Guides
Should a single page app keep session tokens in localStorage?
OWASP advises against session identifiers in localStorage because any XSS can read them. See what to store there, what not to, and safer options to weigh.
Oct 19, 20263 min read
Security Guides
Should a shared Terraform module contain provider blocks?
No. A reusable Terraform module should not define provider blocks. Why it breaks for_each and count, and how to pass providers in from the caller.
Oct 19, 20264 min read
Security Guides
Should a security fix commit say it fixes a vulnerability?
Not in public before users can upgrade. Develop the fix privately, ship it with an advisory, then explain the change in the commit once it is public.
Oct 19, 20263 min read
Security Guides
Should a security bug be a confidential issue in your bug tracker?
Yes. Log a security defect as a confidential ticket until a fix ships. Here is who can see one in GitLab, what to put inside, and mistakes to avoid.
Oct 19, 20264 min read
Security Guides
Should a scanner outage block pull requests: fail open or closed?
When the scanner is down, a required check can halt all merges or let unscanned code through. Choose by risk: fail closed for release, open with a trail for dev.
Oct 19, 20264 min read
Security Guides
Should a revert pull request go through the security gate?
Yes, a revert should still pass the gate, but with a policy that compares against what is already in production so a safe rollback is not blocked.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.