ssrf
Safeguard articles tagged "ssrf" — guides, analysis, and best practices for software supply chain and application security.
46 articles
Commvault CVE-2025-34028: SSRF to RCE in Enterprise Backup Software
A critical SSRF vulnerability in Commvault Command Center allowed unauthenticated attackers to achieve remote code execution on backup infrastructure. CISA added it to the KEV catalog.
How to Validate a URL in JavaScript Without Opening a Hole
The modern way to validate a URL in JavaScript is the built-in URL constructor, not a regex. Here's how to use it safely on both the client and the server.
How to Validate a URL in Python Safely
A practical guide to validating URLs in Python without opening SSRF or injection holes — what the standard library gives you, where it fails, and how to build a safe validator.
The OWASP API Top Ten: What Every API Team Needs to Secure
A practical walkthrough of the OWASP API Top Ten (2023 edition), with the authorization, resource-consumption, and inventory gaps that actually get APIs breached.
What is Server-Side Request Forgery (SSRF)
SSRF turns a server's own trusted network position against it. Learn how the Capital One breach happened, real CVEs, and how to detect and prevent it.
URL Validation in JavaScript: Regex Patterns and Safer Options
URL validation regex in JavaScript is tempting but brittle. Here are patterns that work, the ones that cause ReDoS, and why the URL constructor is usually the better tool.
Is the got npm Package Safe? A Security Review of got for Node.js
got is a well-maintained HTTP client, but one redirect-handling CVE and its SSRF-prone defaults are worth knowing before you ship it. Here is the security review.
XXE Attack Demo: Understanding and Defending Against XML External Entities
An XXE attack demo makes the vulnerability click: an XML parser that trusts external entities can be tricked into reading files or making requests. Here is how it works and how to shut it down.
OWASP API Security Top 10 Explained
The 2023 OWASP API Security Top 10 explained with real breaches — T-Mobile, Optus, Peloton — plus what changed since 2019 and how to prioritize fixes.
Unsafe Consumption of APIs
OWASP's API10:2023 exposes a blind spot: teams sanitize user input but blindly trust API responses from partners, vendors, and internal services.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.