tls
Safeguard articles tagged "tls" — guides, analysis, and best practices for software supply chain and application security.
28 articles
Implementing TLS in Java applications: keystores, trust managers, and protocol pinning done right
One overridden checkServerTrusted() method disables certificate validation for an entire Java app — and it still ships to production more often than most teams admit.
TLS termination and cert-manager: a hardening guide for Kubernetes Ingress
IngressNightmare's CVSS 9.8 RCE showed that ingress-nginx's own admission webhook can be turned against cluster Secrets — here's how to configure TLS safely.
ssl vs. requests vs. httpx: where Python TLS configuration goes wrong
Python didn't verify TLS certificates by default until PEP 476 landed in 2014 — a decade later, one stray verify=False call still reopens that exact hole.
How to actually implement TLS correctly in Python
One `verify=False` in a requests call disables both certificate and hostname checks — the same escape hatch PEP 476 tried to close in 2014.
Building an authenticated, TLS-secured WebSocket server in Python
WebSockets skip same-origin checks by default — CWE-1385 exists because of it. Here's how to build one in Python with origin checks, TLS, and rate limits.
Implementing SSL/TLS certificate pinning in Node.js
HTTP Public Key Pinning died in Chrome 67 back in 2018, yet Node.js apps still need pinning for mobile backends and server-to-server calls — here's how to do it without bricking your own API.
OWASP A02: Cryptographic Failures — A Deep-Dive Guide
Cryptographic Failures rank #2 in the OWASP Top 10 (2021). A deep dive into weak algorithms, key management, real CVEs, and how to detect and fix them in 2026.
Heartbleed (CVE-2014-0160) Explained: When OpenSSL Leaked Memory to Anyone
CVE-2014-0160, Heartbleed, let remote attackers read up to 64KB of an OpenSSL server's memory per request — private keys, sessions, passwords. Here is the missing bounds check that caused it.
What Is the HSTS Header and How Do You Configure It?
The HSTS header forces browsers to talk to your site over HTTPS only. Here is what Strict-Transport-Security does, how to set it safely, and why scanners like Checkmarx flag it as missing.
Is the ioredis npm Package Secure? A Practical Review
The ioredis npm package is a solid, well-maintained Redis client, but most real risk lives in how you configure the connection rather than in the library code itself.
NGINX Ingress TLS: How to Terminate HTTPS Securely on Kubernetes
Configuring NGINX Ingress TLS means wiring up certificates, secrets, and protocol settings so traffic into your cluster is encrypted and hard to downgrade. Here is the secure setup.
CVE-2023-34462: The Netty SniHandler Memory Exhaustion Flaw
CVE-2023-34462 lets a crafted TLS ClientHello force Netty's SniHandler to allocate up to 16MB per connection, opening a denial-of-service path. Here is the root cause, affected versions, and the fix.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.