web-security
Safeguard articles tagged "web-security" — guides, analysis, and best practices for software supply chain and application security.
153 articles
What Is an SSRF Attack? Examples and How to Stop It
An SSRF attack tricks your server into making requests on an attacker's behalf, often reaching internal systems it should never touch. Here is how it works and how to defend against it.
Content Security Policy (CSP) Explained (2026)
A Content Security Policy is your last line of defense against XSS. Here is how CSP works, why nonce-based strict policies beat allowlists, and how to deploy one without breaking your app.
Best DAST Tools in 2026: An Honest Buyer's Guide
A balanced 2026 comparison of the leading dynamic application security testing tools — OWASP ZAP, Burp Suite, Invicti, Rapid7 InsightAppSec, StackHawk, and Bright — with an honest look at where Safeguard fits.
HTTP Security Headers Explained (2026)
HTTP security headers are the cheapest defense-in-depth you can ship. Here is what each one does, the values to set in 2026, and how to verify they are actually present.
SMTP Injection (Email Header Injection): Prevention Guide
A contact form that builds emails from user input can be turned into a spam relay or a phishing generator through SMTP header injection. Here's how the attack works and how to neutralize it.
SSRF Prevention in Go: Blocking Metadata, Redirects, and DNS Rebinding
A single unvalidated URL passed to net/http can hand an attacker your cloud metadata credentials. Here's how SSRF actually works against Go services — and the DialContext-level defense that stops it.
ASP.NET Core Security Checklist for Production
A production-ready ASP.NET Core security checklist covering authentication, headers, HTTPS, antiforgery, rate limiting, and data protection, with the exact configuration for .NET 8 and .NET 9.
Express.js Security Guide (2026)
Express is the default web framework for Node.js — and a small, deep dependency tree that has produced open-redirect, XSS, and ReDoS CVEs. Here is how to run Express safely in 2026.
What is Insecure Deserialization? A Developer's Guide
Insecure deserialization turns a trusted data-loading routine into a remote code execution primitive. Learn how gadget chains work and how to deserialize untrusted data safely.
CVE-2020-11022: XSS in jQuery via htmlPrefilter
CVE-2020-11022 lets attacker-controlled HTML bypass sanitization via jQuery's htmlPrefilter, enabling XSS in versions before 3.5.0. Impact, timeline, and fixes.
Flask Security Best Practices for 2026
Flask is minimal by design, which means the security decisions Django makes for you are decisions you own. Here is how to make them correctly.
Cross-Site Scripting (XSS): A Prevention Guide
XSS lets an attacker run their JavaScript in your users' browsers — stealing sessions, rewriting pages, and pivoting to account takeover. This guide covers the three XSS types and the defenses that actually hold.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.