Application Security
In-depth guides and analysis on application security from the Safeguard engineering team.
100 articles
Container scanning vs runtime protection: which do you need?
Scanning checks images before they run. Runtime protection watches containers as they run. They overlap little and miss different things. Decide by risk.
How do you get secure random numbers in C and C++?
Never use rand or a time-seeded generator for secrets. Ask the OS through getrandom, arc4random_buf or BCryptGenRandom, or use OpenSSL RAND_bytes.
What security baseline does a new Azure subscription need?
A day one Azure baseline: place the subscription in a landing zone, assign least privilege roles at narrow scopes, and switch on the free posture checks.
What belongs on a secure coding checklist for Python teams?
A Python checklist: validate input, avoid pickle and shell=True, use the secrets module, pin dependencies with hashes, and check each item in code review.
How do you prevent cross-site scripting in Rust web apps?
Rust's memory safety does not stop XSS. Use auto-escaping templates, avoid raw output wrappers, encode by context, and add a CSP as a second layer.
How do you prevent XSS in Ruby and Rails apps?
Rails escapes ERB output by default, so XSS hides in raw output, user URLs and a missing CSP. A plain checklist for Ruby teams with a constructed example.
How do you stop XSS in a Kotlin web app (Spring, Ktor)?
Kotlin null safety does not prevent XSS. Keep escaping on in Thymeleaf and HTML builders, avoid unescaped output, encode by context, and add a CSP.
Can a C or C++ web app have XSS, and how do you stop it?
C and C++ services that emit HTML have no automatic escaping unless a template layer adds it. How to find unsafe output paths and encode by context.
How do you prevent XSS in ASP.NET Core and C# web apps?
Razor encodes output by default. XSS in C# apps comes from bypassing it, from untrusted data in scripts and from APIs returning markup. How to find and fix each.
What is XPath injection and how do you find it in code review?
XPath injection lets crafted input change a query on XML data. See a constructed login bypass, the code smells to grep for, and how to fix it properly.
How do you write tests in Python using doctest?
Doctest runs the examples in your docstrings and checks the output. Learn the syntax, the ELLIPSIS option, how to run it and where it stops being enough.
WireGuard vs OpenVPN: which VPN protocol fits your network?
WireGuard is small, fast and UDP only. OpenVPN is older, flexible and can run over TCP. Compare design, limits and the cases where each one fits.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.