secure-coding
Safeguard articles tagged "secure-coding" — guides, analysis, and best practices for software supply chain and application security.
188 articles
What Does CWE Stand For? Common Weakness Enumeration Explained
CWE stands for Common Weakness Enumeration, a community catalog of software and hardware weakness types. Here is what it is and how it differs from CVE.
Why Python's eval() Is Dangerous and What to Use Instead
Python eval() runs arbitrary code, and feeding it untrusted input is a remote code execution bug waiting to happen. Here's the risk, how the exploit works conceptually, and safer alternatives.
Fixing XXE in Java: A Parser-by-Parser Hardening Guide
A parser-by-parser XXE fix for Java, covering DocumentBuilderFactory, SAXParser, XMLInputFactory, TransformerFactory, and the XML libraries that still ship unsafe defaults.
JavaScript Security Best Practices Every Team Should Actually Follow
Most JavaScript security incidents come from a handful of repeated mistakes. These are the best practices that prevent them, from XSS to the npm dependency graph.
What Are Cryptographic Failures
Cryptographic failures are OWASP's #2 Top 10 risk — weak, missing, or broken encryption. See real breaches, causes, and how to detect and fix them.
Input Validation in Cyber Security: Why It Matters and How to Do It
Input validation is a foundational cyber security control that rejects malformed data at the boundary, cutting off entire classes of injection attacks before they start.
OWASP Top 10 Training: A Practical Guide for Developers
What OWASP Top 10 training actually needs to cover in 2026 now that the 2025 list has landed, plus where to find free, developer-focused courses that stick.
Software Security Testing: A Practitioner's Overview
Software security testing spans static analysis, dynamic testing, dependency scanning, and manual review — a practical map of which method catches what, written for people who actually run these programs.
AI Code Checker: What It Catches and What It Misses
An AI code checker uses a language model to review code for bugs and security issues. Here is where it genuinely helps and where trusting it blindly bites you.
What Is Dependency Injection? (And What It Means for Security)
Dependency injection is a design pattern where objects receive their dependencies from outside rather than creating them. It makes code testable and flexible — and it has real security implications.
Risks of AI-Generated Code
AI coding assistants now write nearly half of some codebases—and research shows 45% of that code ships with exploitable flaws. Here's what security teams need to know.
What is the CERT Secure Coding Standard
CERT secure coding standards give C, C++, and Java developers rule-by-rule guidance — with IDs, risk scores, and fix patterns — for avoiding exploitable bugs.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.