DevSecOps
Securing Azure DevOps pipelines against supply chain comp...
Pipelines now hold more privilege than the apps they build. Here's how Azure DevOps pipeline security actually breaks down—and how to close the gaps.
Jan 16, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDependency Security
PHP Composer Dependency Security
Securing PHP applications through Composer lockfiles, Packagist verification, and automated vulnerability scanning.
Jan 15, 20264 min read
Network Security
Network Segmentation for Development Environments: Isolating the Build Pipeline
Development environments are often the weakest link in network security. Proper segmentation isolates build systems from production and prevents lateral movement from compromised developer machines.
Jan 15, 20265 min read
Web Security
Cookie Security for Modern Web Applications
Cookie misconfigurations remain one of the most common web vulnerabilities. From SameSite to cookie prefixes, here is how to configure cookies that resist session hijacking and CSRF attacks.
Jan 15, 20265 min read
Hardware Security
Trusted Computing and TPM in the Software Supply Chain
Trusted Platform Modules provide a hardware root of trust for verifying software integrity. Understanding how TPMs fit into supply chain security helps build tamper-resistant systems.
Jan 15, 20267 min read
DevSecOps
Developer Productivity vs. Security: Finding the Real Balance
The security-productivity tension is real but often exaggerated. Most friction comes from bad tooling and poor processes, not from security itself. Here is how to fix the actual problems.
Jan 15, 20266 min read
Open Source Security
npm Registry Security Gets Serious: 2022's Major Improvements
From mandatory MFA for top packages to enhanced login verification, npm made significant security improvements in 2022. Here's what changed.
Jan 15, 20266 min read
Zero-Day Exploits
ProxyNotShell CVE-2022-41040: Microsoft Exchange Under Fire Again
ProxyNotShell chained two Exchange vulnerabilities for authenticated RCE, exploited in the wild for weeks before Microsoft delivered a patch. Exchange admins were running out of patience.
Jan 15, 20266 min read
Open Source Security
OSS Review Toolkit (ORT): Automating License Compliance at Scale
The OSS Review Toolkit handles license scanning, vulnerability detection, and compliance policy enforcement. Here's how to put it to work.
Jan 15, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.