Organizational Security
Open-Source Contribution Security Guide
How to contribute to open-source projects without introducing security vulnerabilities, and how to evaluate the security posture of projects you contribute to.
Feb 22, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainer Security
Kubernetes admission controller
A Kubernetes admission controller intercepts API requests before they're persisted, enforcing policy on Pods, images, and configs before workloads ever run.
Feb 22, 20267 min read
Best Practices
Django Security Best Practices, 2024 Edition
From SECRET_KEY hygiene to middleware ordering, the Django security checklist worth actually following in 2024, grounded in real CVEs and production incidents.
Feb 21, 20266 min read
SBOM and Compliance
Compliance Dashboard Design Patterns for Supply Chain Security
Compliance dashboards translate complex supply chain data into actionable views for auditors, executives, and engineering teams. These design patterns make the difference between a dashboard that drives action and one that collects dust.
Feb 21, 20266 min read
Policy & Compliance
CISA's Secure by Design Pledge: Voluntary Commitments with Real Teeth
CISA launched a voluntary pledge asking software manufacturers to commit to specific security improvements. Over 100 companies signed. Here is what the pledge actually requires and whether it matters.
Feb 21, 20266 min read
Licensing
Types of Licenses: A Quick Reference for Engineers
Software licenses split into permissive, copyleft, and proprietary categories, each with different obligations. Here's a quick reference for the types of license engineers actually run into.
Feb 21, 20265 min read
Vulnerabilities
CVE-2017-18214: Why an Old CVE Still Shows Up in Scans
CVE-2017-18214 is a ReDoS bug in Moment.js patched back in 2017, yet it keeps surfacing in scans years later because bundled copies and stale lockfiles never got the memo.
Feb 21, 20264 min read
Licensing
Open Source License Types: A Quick Guide for Engineers
Open source license types split into permissive and copyleft, and knowing which one a dependency uses can matter as much as knowing whether it has a CVE.
Feb 21, 20266 min read
Open Source Security
PowerShell Module Supply Chain Security
PowerShell modules are a supply chain people forget exists, and the trust model is weaker than NuGet's. Here is why that matters.
Feb 21, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.