api-security
Safeguard articles tagged "api-security" — guides, analysis, and best practices for software supply chain and application security.
126 articles
Preventing broken access control in Express.js applications
Express.js ships with no built-in authorization layer, making broken access control easy to introduce and hard to catch with pattern-based scanners.
What Is a DTO (Data Transfer Object)? Security Notes for Java and Beyond
A DTO is a plain object that carries data across a boundary. Used well it is also one of your best defenses against mass assignment and data over-exposure.
Why We Use CORS in Node.js: Configuration Without the Foot-Guns
Understanding why we use CORS in Node.js starts with what it is not: CORS is a browser relaxation mechanism, not a security wall. Here is how to configure it in Express without the classic misconfigurations.
OWASP API Top 10 2023: What Changed and How to Defend
The OWASP API Security Top 10 2023 puts authorization failures at the top and adds new risks around business flows and API consumption. Here's the full list with defenses.
OWASP Top 10 Vulnerabilities 2023: A Retrospective That Still Applies
There was no new web OWASP Top 10 in 2023 — but the OWASP Top 10 vulnerabilities 2023 story is really about the 2021 web list holding firm and the API Security Top 10 getting a major refresh.
API Scanner Tools: How They Work and How to Choose One
An API scanner tool probes your endpoints for authentication gaps, injection flaws, and data exposure before attackers do. Here is how the scanning works and what to look for when picking one.
Is swagger-ui-react Safe? A Security Guide for React API Docs
swagger-ui-react has no known direct CVEs, but its real risk lives in a deep dependency tree. Here is how to embed it without inheriting a transitive XSS.
What Is an API Security Tool and How Do You Actually Choose One?
An API security tool inspects, tests, and monitors your APIs for the flaws attackers hunt for. Here is how the categories differ and how to pick the right one.
The OWASP API Top Ten: What Every API Team Needs to Secure
A practical walkthrough of the OWASP API Top Ten (2023 edition), with the authorization, resource-consumption, and inventory gaps that actually get APIs breached.
What is Insecure Direct Object Reference (IDOR)
IDOR lets attackers access other users data just by changing an ID in a URL or API call. Learn how it works, real breaches, and how to fix it.
What is NoSQL Injection
NoSQL injection lets attackers bypass logins or run code using MongoDB operators like $ne and $where. See real CVEs, examples, and effective defenses.
Flask-CORS Security: The 2024 CVEs and How to Configure It Safely
Flask-CORS is easy to enable and easy to misconfigure. A look at the 2024 path-matching CVEs and the configuration mistakes that actually open your API.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.