web-security
Safeguard articles tagged "web-security" — guides, analysis, and best practices for software supply chain and application security.
153 articles
Next.js Security Vulnerability: CVE-2025-29927 Explained
A single spoofed HTTP header could skip your Next.js middleware entirely. Here is what the CVE-2025-29927 authorization bypass is, who it affects, and how to fix it.
Secure Session Management: A Practical Guide for Web Apps
Secure session management comes down to a handful of decisions about cookies, storage, expiry, and rotation. Get those right and you close off most session-based attacks.
PHP Application Security: A Practical Guide to Locking Down Your Code
PHP application security comes down to a handful of high-impact controls. Here is how to handle injection, sessions, uploads, and dependencies without the theory.
JavaScript Injection Attack: How It Works and How to Stop It
A JavaScript injection attack runs attacker-controlled script in a victim's browser or a Node.js process. Here is how the attack class works and the defenses that actually neutralize it.
XXE Examples: Annotated Payloads and Fixes
Concrete xxe examples showing how a malicious external entity reference reads local files or reaches internal services through an XML parser, and the config change that closes it.
Java URL Encode: How to Encode URLs Safely Without Introducing Bugs
The Java URL encode API is easy to reach for and easy to misuse. Here is when to use URLEncoder, when to use URI, and how the wrong choice becomes an injection risk.
Next.js Middleware Authorization Bypass: CVE-2025-29927
A critical flaw in Next.js allowed attackers to bypass middleware-based authorization by setting a single HTTP header. Applications relying on middleware for auth checks were completely exposed.
What Is a DAST Assessment? A Practical Security Guide
A DAST assessment tests a running application from the outside to find exploitable flaws. Here is how it works, what it catches, and where it fits alongside SAST and SCA.
XSS Attack Examples: How Cross-Site Scripting Works and How to Stop It
Walk through realistic XSS attack examples across the three main flavors of cross-site scripting, then see how to detect and remediate each one.
Open Redirect Vulnerabilities: What They Are and How to Fix Them
An open redirect vulnerability fix is usually a ten-line change, but the bug keeps shipping because redirects hide in login flows, tracking links, and OAuth callbacks. Here is how to find and close them.
Free Website Vulnerability Scanners: What You Actually Get
Free scanners catch the obvious stuff — missing headers, expired TLS, a handful of known CVEs — but they stop well short of what a real security program needs.
How to Scan Websites for Security Issues
A practical walkthrough of how to scan websites for common vulnerabilities, which tools fit which job, and how to turn scan output into fixes.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.