Security
In-depth guides and analysis on security from the Safeguard engineering team.
521 articles
XXE Attack Demo: Understanding and Defending Against XML External Entities
An XXE attack demo makes the vulnerability click: an XML parser that trusts external entities can be tricked into reading files or making requests. Here is how it works and how to shut it down.
How Can Malicious Code Do Damage? A Practical Security Guide
Malicious code does damage by abusing the permissions of the process it runs in, then spreading, stealing, or destroying. Here is how each mechanism works and how to blunt it.
CVE Management for SMEs: A Practical Security Guide
A practical CVE guide for SMEs: what a CVE is, how small and medium teams should triage them without a full security department, and where to focus.
The Bootstrap Freelancer Theme: A Security Review Before You Ship It
The Bootstrap Freelancer theme is a popular free portfolio template, but shipping it unchanged pulls in front-end dependencies you need to check first.
Java Deserialization Vulnerabilities: How They Work and How to Stop Them
A practical explanation of the Java deserialization vulnerability class: why untrusted object deserialization leads to remote code execution, and how to defend against it.
Nginx 1.14.2: Which Vulnerabilities Affect It and How to Upgrade
Nginx/1.14.2 is an end-of-life release carrying the resolver heap overwrite, HTTP/2 DoS flaws, and a request-smuggling bug. Here is what applies and the upgrade path.
JSON Patch Security: Prototype Pollution and Safe Usage
JSON Patch (RFC 6902) is a compact format for applying partial updates, but implementations like fast-json-patch have had prototype-pollution flaws. Here is how to use it safely.
Input Validation in Cyber Security: Why It Matters and How to Do It
Input validation is a foundational cyber security control that rejects malformed data at the boundary, cutting off entire classes of injection attacks before they start.
What Makes an Encryption Algorithm Symmetric?
An encryption algorithm is symmetric when the same secret key both encrypts and decrypts the data. That single property shapes its speed, its use cases, and its one hard problem.
How to Build Security Into Every SDLC Phase
Bolting a scan onto release week is not security in the SDLC. Here is what a security control looks like in each phase, and what it costs to skip them.
CVE-2024-0333: The Chrome Extensions Data Validation Flaw Explained
CVE-2024-0333 is an insufficient data validation bug in Chrome's Extensions component that let a network attacker push a malicious extension. Here is what it is and how to stay patched.
Which of the Following Is an Example of Malicious Code?
Viruses, worms, trojans, ransomware, spyware, and logic bombs are all examples of malicious code. Here is how to tell them apart and defend against each.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.