web-security
Safeguard articles tagged "web-security" — guides, analysis, and best practices for software supply chain and application security.
153 articles
Web Session Management: A Security Guide for Developers
Web session management is how an application remembers who a user is across stateless HTTP requests. Get the session identifier, storage, and lifecycle wrong and you hand attackers the keys.
Django Security Best Practices for 2026
Django ships with strong defaults, but misconfigured settings, raw ORM queries, and unpinned dependencies still cause real breaches. Here is the checklist that matters.
What is SSRF (Server-Side Request Forgery)?
Server-side request forgery tricks your own backend into making attacker-chosen requests — often against internal systems it should never reach. Here's how SSRF works and how to shut it down.
browser-image-compression: Is Client-Side Image Compression Safe?
browser-image-compression shrinks images in the browser before upload. Here is how it works, its security trade-offs, and why client-side compression is never validation.
CVE-2022-34265: SQL injection via Trunc/Extract database ...
A technical breakdown of CVE-2022-34265, the Django SQL injection flaw in Trunc() and Extract(), covering affected versions, risk, and remediation steps.
XSS Payloads on GitHub: What Those Repos Contain and How to Defend
Searching for XSS payloads on GitHub turns up huge lists of test strings. Here is what they are actually for, how defenders use them responsibly, and how to stop cross-site scripting in your own code.
URL Scanner: How It Works and What to Use
A URL scanner checks a web address for danger before you visit or ship it — but 'URL scanner' covers two very different tools. Here is how each works and which one solves your problem.
Security in PHP: Framework-Level Protections and Common Gaps
Security in PHP improved enormously once frameworks took over escaping, CSRF, and query building. The remaining incidents live in the gaps where developers step outside those rails.
What Is the HSTS Header and How Do You Configure It?
The HSTS header forces browsers to talk to your site over HTTPS only. Here is what Strict-Transport-Security does, how to set it safely, and why scanners like Checkmarx flag it as missing.
JavaScript Hacking Explained: Attack Classes and Defenses
JavaScript hacking is less about breaking the language and more about abusing how apps handle untrusted input. Here are the main attack classes and how to defend against each.
JavaScript Exploits Explained: How They Work and How to Stop Them
JavaScript exploits target the code that runs in browsers and on Node servers. Here is how the main attack classes work and the defenses that actually hold up.
SSRF Meaning: What Server-Side Request Forgery Is and How to Stop It
SSRF stands for Server-Side Request Forgery, a vulnerability where an attacker tricks your server into making requests on their behalf. Here is what it means, why it is dangerous, and how to defend against it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.