api-security
Safeguard articles tagged "api-security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
OWASP API Top 10 2023: What Changed and How to Defend
The OWASP API Security Top 10 2023 puts authorization failures at the top and adds new risks around business flows and API consumption. Here's the full list with defenses.
OWASP Top 10 Vulnerabilities 2023: A Retrospective That Still Applies
There was no new web OWASP Top 10 in 2023 — but the OWASP Top 10 vulnerabilities 2023 story is really about the 2021 web list holding firm and the API Security Top 10 getting a major refresh.
API Scanner Tools: How They Work and How to Choose One
An API scanner tool probes your endpoints for authentication gaps, injection flaws, and data exposure before attackers do. Here is how the scanning works and what to look for when picking one.
Is swagger-ui-react Safe? A Security Guide for React API Docs
swagger-ui-react has no known direct CVEs, but its real risk lives in a deep dependency tree. Here is how to embed it without inheriting a transitive XSS.
What Is an API Security Tool and How Do You Actually Choose One?
An API security tool inspects, tests, and monitors your APIs for the flaws attackers hunt for. Here is how the categories differ and how to pick the right one.
The OWASP API Top Ten: What Every API Team Needs to Secure
A practical walkthrough of the OWASP API Top Ten (2023 edition), with the authorization, resource-consumption, and inventory gaps that actually get APIs breached.
What is Insecure Direct Object Reference (IDOR)
IDOR lets attackers access other users data just by changing an ID in a URL or API call. Learn how it works, real breaches, and how to fix it.
What is NoSQL Injection
NoSQL injection lets attackers bypass logins or run code using MongoDB operators like $ne and $where. See real CVEs, examples, and effective defenses.
Flask-CORS Security: The 2024 CVEs and How to Configure It Safely
Flask-CORS is easy to enable and easy to misconfigure. A look at the 2024 path-matching CVEs and the configuration mistakes that actually open your API.
What is a Business Logic Vulnerability
Business logic vulnerabilities exploit correct code enforcing the wrong rules. Learn what they are, real breach examples, and how to detect them.
What is Microservices Security
Microservices security means securing service-to-service auth, dependencies, and containers across hundreds of independently deployed services—not one monolith.
What Is a JWT (JSON Web Token)
A JWT is a compact, signed token that carries claims like who a user is between parties. Learn its three parts, how signing works, and the common security pitfalls.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.