owasp
Safeguard articles tagged "owasp" — guides, analysis, and best practices for software supply chain and application security.
141 articles
Secure Coding for Beginners: Writing Code That Resists Attack
Secure coding is not a separate discipline you bolt on later. It is a set of small habits you weave into the way you already write software. Here is a friendly introduction with a first exercise to try today.
What Is an SSRF Attack? Examples and How to Stop It
An SSRF attack tricks your server into making requests on an attacker's behalf, often reaching internal systems it should never touch. Here is how it works and how to defend against it.
XXE Prevention in Go with decoder.DisallowDTD
Go's standard XML parser resists classic XXE by design, but cgo bindings and SAML libraries can reopen it. Here's how the DisallowDTD pattern closes the gap.
Mass Assignment Vulnerability: How to Prevent It
Mass assignment lets attackers set fields you never meant to expose — like isAdmin or accountBalance — by adding them to a request body. Here is the fix.
Application Security FAQ: A 2026 Guide
Clear answers to common application security questions in 2026 — what AppSec covers, how SAST, DAST, and SCA differ, the role of the OWASP Top 10, and how to prioritize fixes.
What Is SSTI (Server-Side Template Injection)?
SSTI happens when user input is compiled as template code instead of rendered as data, often leading straight to remote code execution. Here is how to prevent it.
C# Secure Coding Guide: Patterns That Prevent Real Bugs
A hands-on C# secure coding guide covering input validation, safe APIs, path traversal, injection, and the language-level patterns that keep vulnerabilities out of your code.
What Is XXE (XML External Entity Injection)?
XXE abuses an XML parser's ability to load external entities to read local files, reach internal services, or knock a server offline. Here is how to stop it.
Application Security for Beginners: Where to Start Without Feeling Overwhelmed
Application security sounds intimidating, but the fundamentals are learnable in an afternoon. Here is a warm, practical introduction with a first hands-on step you can try today.
What Is IDOR (Insecure Direct Object Reference)?
IDOR lets an attacker swap an ID in a request and read or change data that belongs to someone else. Here is how it works and how to shut it down.
Web Application Security Standards overview
A breakdown of OWASP, NIST SSDF, and PCI DSS 4.0 web application security standards, where Veracode's scanning model covers them, and where supply-chain gaps remain.
Broken Access Control Examples: Real Cases and How to Fix Them
Broken access control is the number-one web risk on the OWASP Top 10. These examples show what it looks like in real code and how to close each gap.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.