owasp
Safeguard articles tagged "owasp" — guides, analysis, and best practices for software supply chain and application security.
140 articles
What Is an API Security Tool and How Do You Actually Choose One?
An API security tool inspects, tests, and monitors your APIs for the flaws attackers hunt for. Here is how the categories differ and how to pick the right one.
XXE Fix in Java: How to Harden Every XML Parser
The XXE fix in Java is the same idea across every parser — turn off DOCTYPE and external entities before you feed it untrusted XML. Here are the exact settings for each JDK XML API.
Website Vulnerability Assessment: A Practical How-To Guide
A website vulnerability assessment systematically finds and ranks the security weaknesses in a web app. Here is the process, the tools, and the pitfalls.
SQL Injection Demo: How the Attack Works and How to Stop It
A practical SQL injection demo that shows how unsanitized input reaches the database, why it works, and the one fix that reliably closes the hole.
Unrestricted File Upload Vulnerabilities: Risks and Fixes
An unrestricted file upload vulnerability lets an attacker place a working web shell on your server through a form that was only ever supposed to accept profile pictures or PDFs.
Input Validation in Cyber Security: Why It Matters and How to Do It
Input validation is a foundational cyber security control that rejects malformed data at the boundary, cutting off entire classes of injection attacks before they start.
SQL Injection Examples: Real Attack Patterns and How to Stop Them
SQL injection examples that show the attack patterns behind the CWE, why they work, and the parameterized-query fix that stops all of them at once.
SSRF Attacks: How Server-Side Request Forgery Works
SSRF tricks a server into making requests an attacker controls — reaching internal services, cloud metadata endpoints, and data no external user should touch. Here is how it works and how to stop it.
SQL Injection: How It Works and How It's Actually Tested
A defender's walkthrough of how SQL injection works and how security testers actually verify it in a controlled, authorized assessment — not a how-to-attack guide.
A CSRF Example: Full Attack Walkthrough
A concrete csrf example — a bank transfer form with no anti-forgery token — showing exactly how a forged request rides in on a victim's session and what stops it.
XSS Scripting Attacks: A Refresher for Engineers
XSS scripting attacks still make the OWASP Top 10 more than two decades after they were first documented, mostly because the fix is context-dependent and easy to get almost-right.
What Is CWE? The Common Weakness Enumeration Explained
CWE catalogs the underlying software weakness behind a vulnerability, not the specific instance of it — here's how it relates to CVE and why scanners tag findings with a CWE ID.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.