DevSecOps
How to Choose a Python Code Checker for Secure Code
A Python code checker is more than a linter. Here is how the layers fit together, which open-source tools do what, and where online checkers help and hurt.
May 25, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAppSec
jwks-rsa: Verifying JWTs Against a JWKS Endpoint Safely
The jwks-rsa npm library fetches signing keys from a JWKS endpoint so you can verify JWTs correctly. Here is how to wire it up without introducing key-confusion or availability bugs.
May 25, 20267 min read
Application Security
10 Spring Boot security best practices
Ten concrete Spring Boot security practices, with real CVEs, config flags, and file paths, to close the gaps attackers actually exploit.
May 25, 20267 min read
Security
Zombie APIs: The Forgotten Endpoints That Put You at Risk
A zombie API is a forgotten, undocumented endpoint that still runs and still accepts traffic. Here is why they are dangerous and how to find and kill them.
May 25, 20266 min read
Application Security
Best application security testing providers ranked
Mend.io built its reputation on SCA and open source dependency scanning. Here's how Safeguard's supply chain security approach compares.
May 25, 20267 min read
AppSec
OWASP 2019: The API Security Top 10 That Reshaped API Testing
The OWASP release everyone means by 2019 is the first API Security Top 10, which put authorization flaws — not injection — at the center of API risk.
May 25, 20266 min read
DevSecOps
@types/node Explained: What the Package Does and Why It Matters for Security
@types/node is the TypeScript definitions for Node.js, pulled from DefinitelyTyped. Here is how it works, why version drift causes headaches, and its real supply-chain footprint.
May 25, 20266 min read
Application Security
A guide to input validation with Spring Boot
Spring Boot doesn't validate input by default. Here's how Bean Validation actually works, where teams get it wrong, and how missing validation leads to injection and mass assignment.
May 25, 20266 min read
Container Security
Top container security tools to evaluate
Comparing Safeguard and Mend.io on the dimensions that actually matter for container security: scanning engine transparency, offline support, registry coverage, and product origin.
May 25, 20268 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.