owasp
Safeguard articles tagged "owasp" — guides, analysis, and best practices for software supply chain and application security.
141 articles
cdxgen v12: Reachability Evidence Lands in SBOMs
OWASP's cdxgen v12 ships reachability evidence powered by atom, multi-BOM generation (SBOM, CBOM, SaaSBOM, OBOM, CDXA), and CycloneDX 1.7 as the default. We tested it on a Java monorepo.
What Is a Code Injection Attack and How Do You Prevent It?
A code injection attack tricks an application into running attacker-supplied code as if it were trusted. Here is how the class works and how to shut it down.
Open Redirect Vulnerabilities: What They Are and How to Fix Them
An open redirect vulnerability fix is usually a ten-line change, but the bug keeps shipping because redirects hide in login flows, tracking links, and OAuth callbacks. Here is how to find and close them.
What Is an API Security Tool and How Do You Actually Choose One?
An API security tool inspects, tests, and monitors your APIs for the flaws attackers hunt for. Here is how the categories differ and how to pick the right one.
XXE Fix in Java: How to Harden Every XML Parser
The XXE fix in Java is the same idea across every parser — turn off DOCTYPE and external entities before you feed it untrusted XML. Here are the exact settings for each JDK XML API.
What is Directory Traversal
Directory traversal (CWE-22) lets attackers use ../ sequences to read or write files outside a web app's root directory. Here's how it works.
What is Clickjacking
Clickjacking tricks users into clicking hidden UI via invisible iframes. Learn how it works, real incidents, key CVEs, and how to defend against it.
Website Vulnerability Assessment: A Practical How-To Guide
A website vulnerability assessment systematically finds and ranks the security weaknesses in a web app. Here is the process, the tools, and the pitfalls.
What is Session Hijacking
Session hijacking lets attackers seize an active, authenticated session and bypass passwords and MFA entirely. Here's how it works and how to stop it.
SQL Injection Demo: How the Attack Works and How to Stop It
A practical SQL injection demo that shows how unsanitized input reaches the database, why it works, and the one fix that reliably closes the hole.
Unrestricted File Upload Vulnerabilities: Risks and Fixes
An unrestricted file upload vulnerability lets an attacker place a working web shell on your server through a form that was only ever supposed to accept profile pictures or PDFs.
Input Validation in Cyber Security: Why It Matters and How to Do It
Input validation is a foundational cyber security control that rejects malformed data at the boundary, cutting off entire classes of injection attacks before they start.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.