api-security
Safeguard articles tagged "api-security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Application Layer Security: What It Covers (and What It Doesn't)
Application layer security protects the code, logic, and APIs at the top of the OSI stack, but it's easy to confuse it with network or infrastructure security controls that solve a different problem.
API Security Scanning: What Good Tools Actually Catch
API security scanning explained in terms of the specific failure classes it catches, from broken object-level authorization to shadow endpoints, and why generic web scanners miss most of them.
The OWASP API Security Top 10: Each Risk Explained
The OWASP API Top 10 is a ranked list of the most common API-specific vulnerability classes, from broken object level authorization to unsafe consumption of third-party APIs.
CORS Headers Explained: How to Configure Them Without Opening Holes
CORS headers tell a browser which cross-origin requests to a resource are allowed. Get them right and you enable legitimate clients; get them wrong and you hand attackers a door.
API Security Software: What It Does and How to Choose It
API security software protects the endpoints that carry most of your traffic and data. Here is what these tools actually do, the categories that matter, and how to choose without duplicating coverage.
Improving GraphQL security with static analysis
GraphQL's flexible query model breaks REST-era security assumptions. Here's how static analysis catches introspection leaks, DoS, and BOLA before deploy.
Building a secure GraphQL API with Node.js
A practical guide to securing Node.js GraphQL APIs: query complexity limits, field-level authorization, injection-safe resolvers, and CSRF hardening.
Microservices security: authentication between services
Service-to-service auth stops lateral movement between microservices. Learn how mTLS, OAuth2, and SPIFFE/SPIRE secure internal calls in production.
Securing a REST API: A Defense-in-Depth Checklist
Securing a REST API means layering authentication, authorization, input validation, and rate limiting so no single control is the only thing standing between an attacker and your data.
Preventing broken access control in Express.js applications
Express.js ships with no built-in authorization layer, making broken access control easy to introduce and hard to catch with pattern-based scanners.
What Is a DTO (Data Transfer Object)? Security Notes for Java and Beyond
A DTO is a plain object that carries data across a boundary. Used well it is also one of your best defenses against mass assignment and data over-exposure.
Why We Use CORS in Node.js: Configuration Without the Foot-Guns
Understanding why we use CORS in Node.js starts with what it is not: CORS is a browser relaxation mechanism, not a security wall. Here is how to configure it in Express without the classic misconfigurations.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.