Best Practices
Shifting Left Without Slowing Down
How to integrate security earlier in the development lifecycle without turning your CI pipeline into a bottleneck that developers hate.
Jun 15, 20226 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
How to integrate security earlier in the development lifecycle without turning your CI pipeline into a bottleneck that developers hate.
The 2021 OWASP Top 10 added supply chain risks for the first time. Here is what each category means when your code is mostly someone else's code.
Six months after CVE-2021-44228 broke the internet, here is what worked, what didn't, and the response patterns security teams should keep as muscle memory.
Package signing is the backbone of Linux software distribution security. Most teams trust it blindly without understanding the verification chain they depend on.
App store review processes catch most malware. But the bypass techniques that work reveal systematic gaps in mobile supply chain security.
Electron apps ship a full Chromium browser and Node.js runtime to the desktop. That means every web supply chain risk becomes a desktop attack surface — with elevated privileges.
A Word document, no macros enabled, and full remote code execution. Follina exploited the Microsoft Support Diagnostic Tool via ms-msdt protocol handlers, rendering years of macro-blocking defenses irrelevant.
Image scanning finds known vulnerabilities before deployment. Runtime monitoring catches actual exploitation, zero-days, and behavioral anomalies after deployment. You need both.
A practical guide to securing your software supply chain on AWS, from ECR image provenance to CodePipeline hardening.
Weekly insights on software supply chain security, delivered to your inbox.