Application Security
Safeguard articles tagged "Application Security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
What security baseline does a new Azure subscription need?
A day one Azure baseline: place the subscription in a landing zone, assign least privilege roles at narrow scopes, and switch on the free posture checks.
What belongs on a secure coding checklist for Python teams?
A Python checklist: validate input, avoid pickle and shell=True, use the secrets module, pin dependencies with hashes, and check each item in code review.
How do you prevent cross-site scripting in Rust web apps?
Rust's memory safety does not stop XSS. Use auto-escaping templates, avoid raw output wrappers, encode by context, and add a CSP as a second layer.
How do you prevent XSS in Ruby and Rails apps?
Rails escapes ERB output by default, so XSS hides in raw output, user URLs and a missing CSP. A plain checklist for Ruby teams with a constructed example.
How do you stop XSS in a Kotlin web app (Spring, Ktor)?
Kotlin null safety does not prevent XSS. Keep escaping on in Thymeleaf and HTML builders, avoid unescaped output, encode by context, and add a CSP.
Can a C or C++ web app have XSS, and how do you stop it?
C and C++ services that emit HTML have no automatic escaping unless a template layer adds it. How to find unsafe output paths and encode by context.
How do you prevent XSS in ASP.NET Core and C# web apps?
Razor encodes output by default. XSS in C# apps comes from bypassing it, from untrusted data in scripts and from APIs returning markup. How to find and fix each.
What is XPath injection and how do you find it in code review?
XPath injection lets crafted input change a query on XML data. See a constructed login bypass, the code smells to grep for, and how to fix it properly.
How do you write tests in Python using doctest?
Doctest runs the examples in your docstrings and checks the output. Learn the syntax, the ELLIPSIS option, how to run it and where it stops being enough.
WireGuard vs OpenVPN: which VPN protocol fits your network?
WireGuard is small, fast and UDP only. OpenVPN is older, flexible and can run over TCP. Compare design, limits and the cases where each one fits.
Is vulnerability triage going away or just changing?
Triage is shifting from manual sorting to automated filtering by reachability and exploit signals. People set policy and decide the exceptions.
Why do you need cloud security if the provider secures the cloud?
Providers secure the infrastructure, but you secure your data, identities and settings. See where the line sits and five common gaps in cloud setups.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.