Security Guides
Self-hosted Mac runner cleanup: keychains and profiles checklist
A self-hosted Mac runner can keep signing keys and profiles after a job ends. A checklist of what to delete, when, and what to check each week.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How do I see what an EPSS score was on a past date?
Use the EPSS API date parameter for a single CVE, or the public daily archive for many. Steps to rebuild what you knew when you made a patch decision.
Oct 19, 20264 min read
Security Guides
Data handling answers that should worry you, and what to ask next
Vague or absolute answers about data handling are warning signs. Here are common red flag phrases from security vendors and a better follow-up for each.
Oct 19, 20264 min read
Security Guides
Should you sign your security.txt file, and what is Canonical?
RFC 9116 recommends signing security.txt with an OpenPGP cleartext signature and adding a Canonical field. What each does and how to set them up.
Oct 19, 20263 min read
Security Guides
Which optional security.txt fields are worth adding?
Beyond Contact and Expires, RFC 9116 defines Policy, Acknowledgments, Encryption, Preferred-Languages and more. What each does and which to add first.
Oct 19, 20263 min read
Security Guides
What does the Expires field in security.txt mean?
The Expires field in security.txt must be present and tells researchers when your contact details go stale. What to set, what RFC 9116 says, how to renew.
Oct 19, 20264 min read
Security Guides
What are security.txt and SECURITY.md, and does your SDK need both?
security.txt (RFC 9116) tells researchers how to reach you from your website; SECURITY.md does it in your repo. Fields, location and a setup checklist.
Oct 19, 20264 min read
Security Guides
Which security training metrics are vanity metrics?
Completion rate, hours logged and quiz scores say little about whether developers write safer code. Which metrics to retire and what to track instead.
Oct 19, 20263 min read
Security Guides
How should QA and test engineers be trained in security testing?
QA and test engineers can add real security coverage with targeted training: abuse cases, authorization tests and using the OWASP Web Security Testing Guide.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.