web-security
Safeguard articles tagged "web-security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Subresource Integrity (SRI) Explained (2026)
Subresource Integrity pins a cryptographic hash to every script you load from a CDN, so a compromised CDN cannot silently swap in malicious code. Here is how it works and where it stops.
Securing Express Applications: A Layered Playbook
Express gives you almost no security by default. This playbook layers the middleware, headers, rate limits, session hardening, and input validation that turn a bare Express app into a defensible one — with Express 5 in mind.
What Is an SSRF Attack? Examples and How to Stop It
An SSRF attack tricks your server into making requests on an attacker's behalf, often reaching internal systems it should never touch. Here is how it works and how to defend against it.
Content Security Policy (CSP) Explained (2026)
A Content Security Policy is your last line of defense against XSS. Here is how CSP works, why nonce-based strict policies beat allowlists, and how to deploy one without breaking your app.
Best DAST Tools in 2026: An Honest Buyer's Guide
A balanced 2026 comparison of the leading dynamic application security testing tools — OWASP ZAP, Burp Suite, Invicti, Rapid7 InsightAppSec, StackHawk, and Bright — with an honest look at where Safeguard fits.
SMTP Injection (Email Header Injection): Prevention Guide
A contact form that builds emails from user input can be turned into a spam relay or a phishing generator through SMTP header injection. Here's how the attack works and how to neutralize it.
HTTP Security Headers Explained (2026)
HTTP security headers are the cheapest defense-in-depth you can ship. Here is what each one does, the values to set in 2026, and how to verify they are actually present.
SSRF Prevention in Go: Blocking Metadata, Redirects, and DNS Rebinding
A single unvalidated URL passed to net/http can hand an attacker your cloud metadata credentials. Here's how SSRF actually works against Go services — and the DialContext-level defense that stops it.
Express.js Security Guide (2026)
Express is the default web framework for Node.js — and a small, deep dependency tree that has produced open-redirect, XSS, and ReDoS CVEs. Here is how to run Express safely in 2026.
ASP.NET Core Security Checklist for Production
A production-ready ASP.NET Core security checklist covering authentication, headers, HTTPS, antiforgery, rate limiting, and data protection, with the exact configuration for .NET 8 and .NET 9.
What is Insecure Deserialization? A Developer's Guide
Insecure deserialization turns a trusted data-loading routine into a remote code execution primitive. Learn how gadget chains work and how to deserialize untrusted data safely.
CVE-2020-11022: XSS in jQuery via htmlPrefilter
CVE-2020-11022 lets attacker-controlled HTML bypass sanitization via jQuery's htmlPrefilter, enabling XSS in versions before 3.5.0. Impact, timeline, and fixes.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.