Security
In-depth guides and analysis on security from the Safeguard engineering team.
523 articles
CVE-2022-31630: The PHP GD imageloadfont() Out-of-Bounds Read Explained
CVE-2022-31630 is an out-of-bounds read in PHP's GD extension triggered through imageloadfont(). Here are the affected versions, real impact, and the fix.
How to Use PyPI openpyxl Safely: Security Risks and Fixes
The openpyxl package on PyPI is safe for most workloads, but XML parsing and spreadsheet formula injection deserve attention. Here is what to watch for.
eslint-plugin-jest-dom: What It Secures and What It Does Not
eslint-plugin-jest-dom enforces better jest-dom assertions, but as a dev dependency it also lives in your supply chain. Here is where its real security value and its real risk both sit.
What a Static Application Security Test Catches (and What It Misses)
A clear-eyed look at the static application security test: how SAST works, the vulnerability classes it finds, its blind spots and false positives, and how to run it without drowning developers.
CVE-2023-45857: The Axios XSRF Token Leak Explained
How CVE-2023-45857 caused Axios to leak XSRF tokens to any host over cross-origin requests, who is affected, and the one-line upgrade that fixes it.
nginx/1.18.0 (ubuntu): What the Server Banner Reveals and How to Reduce Risk
Seeing nginx/1.18.0 (ubuntu) in a Server header tells you the version, the packaging, and roughly the age of a deployment. Here is what that string implies for security and what to check before assuming you are exposed.
awesome-typescript-loader: Why to Migrate Off It
awesome-typescript-loader is an unmaintained webpack loader for TypeScript. Here is the security case for migrating to ts-loader and how to do it cleanly.
Types of Vulnerability Assessments and When to Use Each
Network, host, application, database, wireless, and cloud assessments each answer a different question. Knowing which type fits which risk is half the job.
The Main Types of Asymmetric Encryption, Explained
The types of asymmetric encryption come down to a few families built on hard math problems: RSA, elliptic curve, Diffie-Hellman, and the post-quantum newcomers. Here is how each works and when to use it.
How to Hash a Password in Java the Right Way in 2025
To hash a password in Java, use a slow, salted, adaptive algorithm like bcrypt or Argon2 — never a raw SHA or MD5 digest. This guide shows working code and the tuning that actually matters.
CVE-2021-41183: jQuery UI Datepicker XSS and How to Fix It
CVE-2021-41183 is a cross-site scripting flaw in the jQuery UI Datepicker's *Text options, fixed in 1.13.0. Here is the risk and the remediation.
Semgrep Open Source: What It Scans and How to Use It Well
Semgrep open source is a fast, rule-based static analysis engine for finding bugs and security issues. Here is what the free CLI covers and where its limits are.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.