Security
In-depth guides and analysis on security from the Safeguard engineering team.
523 articles
Inversion of Control in JavaScript: The Security Angle Nobody Explains
Inversion of control in JavaScript decouples your code from its dependencies, but handing over instantiation also hands over a piece of your attack surface. Here is how to get the design benefit without the security cost.
What Is an IAM Permission Boundary and When to Use One
An IAM permission boundary is a ceiling on what a role or user can ever do, no matter how generous their attached policies are. Here is how to wield it without locking yourself out.
CVE-2022-45688: The Hutool JSON Stack Overflow, Explained
CVE-2022-45688 is a stack-overflow denial-of-service bug in the XML-to-JSON conversion path of hutool-json and org.json. Here is what triggers it and how to fix it.
CVE-2022-45146: Bouncy Castle FIPS Use-After-Free Explained
CVE-2022-45146 is a use-after-free issue in Bouncy Castle's FIPS Java API that surfaces on Java 13 and later. Here is who it affects and how to remediate.
What Is Checkmarx One? A Practical Look at the AppSec Platform
Checkmarx One is Checkmarx's cloud application security platform, bundling SAST, SCA, IaC, and more into a single console. Here is what it covers and where it fits.
The Pen Testing Tools Worth Knowing in 2025
The right pen testing tools depend on what you're assessing. Here's a practical map of the categories, the well-known options in each, and how they fit a defensive program.
MIT-Lizenz: Was sie erlaubt und was kommerzielle Nutzung bedeutet
Die MIT-Lizenz ist eine der freizuegigsten Open-Source-Lizenzen und erlaubt auch die kommerzielle Nutzung. Wir erklaeren Pflichten, Grenzen und Risiken.
ng-bootstrap: Using and Securing Angular's Bootstrap Widgets
ng-bootstrap gives Angular apps native Bootstrap widgets with no jQuery dependency. Here is how to keep it current and where the real security work actually lives.
nginx/1.21.5: Which CVEs Affect It and How to Patch
If your Server header reads nginx/1.21.5, you are running an old mainline release. Here is what it is vulnerable to and the safe versions to move to.
The DevSecOps Process, Explained Stage by Stage
A DevSecOps process bakes security into every step of the software delivery lifecycle instead of bolting it on at the end. Here is what each stage actually looks like.
Copyleft vs Copyright: What the Difference Means for Your Dependencies
A practical breakdown of copyleft vs copyright, how copyleft licenses like the GPL actually work, and why the distinction shows up in your software bill of materials.
How to Check Website Vulnerability: A Practical Guide
To check website vulnerability properly you combine automated scanning of the running app with dependency analysis of what it's built from. Here's a workflow that covers both.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.