secure-coding
Safeguard articles tagged "secure-coding" — guides, analysis, and best practices for software supply chain and application security.
188 articles
Preventing SQL Injection: A Defense-in-Depth Approach
Parameterized queries stop most SQL injection, but the attacks that make it to production usually slip past a single control — here's the layered defense that catches the rest.
What Is a Security Development Model and How Do You Run One?
A security development model bakes threat modeling, code review, and testing into every stage of the SDLC instead of bolting security on at the end. Here is how the model works in practice.
A Practical Race Condition Example (and How to Fix It)
A race condition example is easiest to understand through a bank-balance check-then-act bug. Here is the anatomy, the exploit, and three ways to close it.
Use-After-Free Vulnerability: How It Works and How to Prevent It
A use-after-free vulnerability happens when a program keeps using memory it already released. Here is why it is dangerous, how attackers exploit it, and how to catch it.
What Is This Code? How to Read and Secure Unfamiliar Source
A practical method for answering "what is this code?" when you inherit an unfamiliar file, plus how to spot the security problems hiding inside it.
How to Avoid SQL Injection: A Developer's Guide
To avoid SQL injection, never build queries by concatenating user input, use parameterized queries everywhere, and treat every input as untrusted. Here's the defensive playbook.
How Does SQL Injection Work
A technical walkthrough of how SQL injection works, the main attack variants, real breaches it caused, and how to detect and prevent it.
What is Cross-Site Request Forgery (CSRF)
CSRF forges an authenticated request using a victim's own session cookie. Learn how it works, real Gmail/YouTube cases, and how to detect and fix it.
SAST Definition: What Static Application Security Testing Actually Means
The SAST definition, in plain terms: analyzing source code for vulnerabilities without running it. Here is how it works, what it catches, and where it falls short.
Source Code Auditing: How to Find Bugs Before Attackers Do
Source code auditing is the systematic review of code for security flaws. Here is how to run one, where automation fits, and what humans still do better.
What is Command Injection
Command injection lets attackers run OS commands through unsanitized input. Learn how it works, real CVEs like Shellshock and PAN-OS, and how to prevent it.
Code Quality Analysis and Security: Why Clean Code Is Safer Code
Code quality analysis and security testing overlap more than teams realize. Here is how measuring quality catches whole classes of vulnerabilities early.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.