xss
Safeguard articles tagged "xss" — guides, analysis, and best practices for software supply chain and application security.
86 articles
Antd Injection: Preventing XSS in Ant Design Applications
Antd injection risk is not a flaw in the component library itself but in how you feed it untrusted data. Here is where the danger lives and how to close it.
prism-react-renderer: Safe Syntax Highlighting in React
prism-react-renderer gives you tokenized syntax highlighting in React without dangerouslySetInnerHTML. Here is how it works, why that matters for XSS, and how to keep the dependency healthy.
tinymce-angular Security: What to Know Before You Ship
The tinymce-angular wrapper is thin, but it ships a full rich-text editor whose sanitization gaps have produced real XSS CVEs. Here is how to use it safely.
dom-to-image-more: Using the DOM-to-Image Fork Safely
dom-to-image-more turns a DOM node into a PNG, JPEG, or SVG in the browser. What the fork fixes, and the security considerations when rendering user content.
sanitize-html Vulnerabilities: History and Correct Configuration
A walk through the real npm sanitize-html vulnerabilities, from the 2016 recursion bypass to the 2024 style-attribute leak, and the configuration that keeps the library safe.
PHP Security Issues: The Vulnerabilities That Still Bite in 2025
Most PHP security issues come down to a handful of repeatable mistakes: unsanitized input, weak session handling, and outdated dependencies. Here is what breaks and how to fix it.
Is html-react-parser Safe? Rendering HTML in React Without an XSS Hole
html-react-parser converts an HTML string into React elements, but it is not a sanitizer. Here is how to use it and where the XSS risk really sits.
Interpolation in Angular: How It Works and Where the XSS Risks Hide
Interpolation in Angular binds component data into templates and is safe by default because Angular escapes it. The danger starts when you reach for bypasses.
Is jQuery Validate Safe? Security Risks and Fixes for the Validation Plugin
jQuery Validate is convenient, but a real XSS flaw and the habit of grabbing minified copies off random CDNs make it worth a security look. Here is what to check.
react-signature-canvas: A Security and Maintenance Review
A security review of react-signature-canvas: what the component does, its inactive maintenance status, the XSS surface to watch, and how to use it safely.
react-native-webview Security: Hardening WebViews in Mobile Apps
The react-native-webview component gives your app a browser inside the app, and that power is exactly why it needs careful configuration to avoid opening a hole in your mobile security.
Understanding DOM XSS Payloads: How They Work and How to Stop Them
DOM XSS payloads execute entirely in the browser when untrusted input reaches a dangerous sink like innerHTML or eval. Here is how the class works and how to shut it down without shipping exploit code.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.