Application Security
In-depth guides and analysis on application security from the Safeguard engineering team.
100 articles
A Link Is Fetched Before Anyone Clicks It
Paste a URL into a chat message and a server fetches it automatically to build a preview card, before anyone reads the message or clicks anything. That fetch consumes a single-use link or a time-limited token just as effectively as the intended recipient would have.
Your Access Review Checks One Node in a Graph
A user's permission listing shows no administrative access. By every direct check, they are ordinary. They can still become an administrator through a permission that looks unrelated, was granted for an unrelated reason, and lets them modify something that leads there.
Just-in-Time Provisioning Moves Trust From a Person to a Claim in a Token
A new employee signs in with SSO for the first time, and your application creates an account and assigns a role based on group claims from the identity provider, with no human in the loop to notice if the claim maps to more access than intended.
Two Correct Parsers Can Disagree About the Same Multipart Request
A duplicate field name, an unusual boundary, a malformed header. Two standards-compliant parsers can resolve the same ambiguous bytes differently, and if a validator reads one interpretation while your application reads another, validation passed something it never actually checked.
Nobody Chose to Fail Open. The Catch Block Did.
A permission check that throws, times out, or returns something unexpected proceeds as though access were granted, because a broad catch block written to handle an operational problem silently became an authorization bypass.
An Uploaded File Can Be Two Formats at Once, and Your Validation Only Checked One
A user's file passes every image validation check your upload handler runs. It is also, independently and simultaneously, a valid HTML document, and browser MIME sniffing can choose to render that instead when your response headers do not stop it.
Account Linking by Email Match Trusts a Claim, Not a Verification
Continue with Google links to the matching existing account by email address. That is correct when the identity provider genuinely verified the email. Some providers make verification optional, and not every system checks which claim it is reading.
The Permission You Just Revoked, According to a Replica That Has Not Heard Yet
A user is removed from a project. The write succeeds on the primary immediately. For the next several hundred milliseconds, a read replica still shows them as a member, and if any authorization check reads from it, they can still act.
Search Your Wiki for the Word Password Right Now
A database credential pasted into a setup guide, an API key in a runbook written during an outage, a shared vendor login on a page titled useful links. Nobody put it there to be careless, and it has been searchable ever since.
An Idempotency Key That Only Checks Prior Receipt Protects Nothing
A client retries a timed-out payment request. Both copies arrive close together, both pass the check for whether the key exists, because neither has finished processing yet, and both charge the card.
postMessage Has No Default Access Control
Your embeddable widget talks to the page hosting it across origins. Anything that can get a reference to that window can send it a message, and unless the listener checks who sent it, the widget will act on a message from anywhere.
Your Feature Flag Targeting Rules Are Visible in the Browser
To evaluate flags locally, the client-side SDK needs the targeting rules: which accounts get the enterprise preview, the pricing tier conditions, the churn-risk exclusions. Open the network panel and anyone can read all of it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.