DevSecOps
Tekton Pipelines Hardening Guide
A practical hardening guide for Tekton Pipelines covering TaskRun isolation, step image provenance, workspace secrets, and the CVE history that shaped the current defaults.
Feb 17, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainer Security
How to encrypt Kubernetes secrets at rest
A step-by-step guide to encrypting Kubernetes secrets at rest: choosing a KMS provider, configuring etcd encryption, re-encrypting existing secrets, and verifying it worked.
Feb 17, 20268 min read
Open Source Security
How to Publish an npm Package With Provenance
A step-by-step tutorial for publishing npm packages with provenance attestations so your consumers can cryptographically verify the build source.
Feb 16, 20266 min read
DevSecOps
CI/CD Compromise Investigation Steps
A step-by-step investigation playbook for suspected CI/CD pipeline compromise, from runner forensics to secrets rotation.
Feb 16, 20266 min read
Application Security
Certificate Pinning for Software Updates: When and How to Pin
Certificate pinning can protect your update channel from MITM attacks, but it introduces operational complexity. Here is when pinning makes sense and how to do it safely.
Feb 16, 20264 min read
Security Management
Security KPI Frameworks: Measuring What Matters Without Drowning in Metrics
Most security metrics measure activity, not outcomes. Here is how to build a KPI framework that tells leadership whether the security program is actually reducing risk.
Feb 16, 20265 min read
Application Security
Mobile Application Security Testing: Beyond the OWASP Mobile Top 10
Mobile apps have unique security challenges that web-focused tools miss entirely. Here is a practical testing methodology for iOS and Android.
Feb 16, 20266 min read
Licensing
GPLv3 License: What Changed From GPLv2
GPLv3 added patent protection and anti-tivoization clauses that GPLv2 never had. Here's what actually changed and why it still matters for dependency compliance.
Feb 16, 20265 min read
Licensing
The AGPL-3.0 License, Explained
AGPL-3.0 is the GNU Affero General Public License v3.0 — GPLv3 with one added clause that closes the SaaS loophole, requiring source disclosure even when software is only used over a network, never distributed.
Feb 16, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.