graphql
Safeguard articles tagged "graphql" — guides, analysis, and best practices for software supply chain and application security.
5 articles
GraphQL Moved Your Authorisation Checks and Most Teams Left Them Behind
In REST an operation has one endpoint, so the check has one place to live. In a graph a field can be reached by many paths, and a check on the top-level query does not protect the same data reached as a nested field.
API security fundamentals: mapping the OWASP API Top 10 to real tests
OWASP's 2023 API Security Top 10 lists 10 risk categories — most start with a single curl request. Here's how to test and fix each one.
A primer on the OWASP API Security Top 10 and how to test for it
The OWASP API Security Top 10 dropped Injection entirely in its 2023 update and added SSRF — most REST and GraphQL teams still test for the old list.
The dataloader npm Package: Security Review and Safe Usage
The dataloader npm package batches and caches data fetches, most often in GraphQL servers. Its security story is less about CVEs and more about cache scoping and how you use it.
GraphQL Supply Chain Security Considerations
Supply chain risks specific to GraphQL stacks: Apollo, graphql-js, persisted queries, introspection, and transitive risk in gateway federation.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.