xss
Safeguard articles tagged "xss" — guides, analysis, and best practices for software supply chain and application security.
86 articles
dom-to-image-more: Using the DOM-to-Image Fork Safely
dom-to-image-more turns a DOM node into a PNG, JPEG, or SVG in the browser. What the fork fixes, and the security considerations when rendering user content.
sanitize-html Vulnerabilities: History and Correct Configuration
A walk through the real npm sanitize-html vulnerabilities, from the 2016 recursion bypass to the 2024 style-attribute leak, and the configuration that keeps the library safe.
PHP Security Issues: The Vulnerabilities That Still Bite in 2025
Most PHP security issues come down to a handful of repeatable mistakes: unsanitized input, weak session handling, and outdated dependencies. Here is what breaks and how to fix it.
Is html-react-parser Safe? Rendering HTML in React Without an XSS Hole
html-react-parser converts an HTML string into React elements, but it is not a sanitizer. Here is how to use it and where the XSS risk really sits.
Interpolation in Angular: How It Works and Where the XSS Risks Hide
Interpolation in Angular binds component data into templates and is safe by default because Angular escapes it. The danger starts when you reach for bypasses.
Is jQuery Validate Safe? Security Risks and Fixes for the Validation Plugin
jQuery Validate is convenient, but a real XSS flaw and the habit of grabbing minified copies off random CDNs make it worth a security look. Here is what to check.
react-signature-canvas: A Security and Maintenance Review
A security review of react-signature-canvas: what the component does, its inactive maintenance status, the XSS surface to watch, and how to use it safely.
react-native-webview Security: Hardening WebViews in Mobile Apps
The react-native-webview component gives your app a browser inside the app, and that power is exactly why it needs careful configuration to avoid opening a hole in your mobile security.
Understanding DOM XSS Payloads: How They Work and How to Stop Them
DOM XSS payloads execute entirely in the browser when untrusted input reaches a dangerous sink like innerHTML or eval. Here is how the class works and how to shut it down without shipping exploit code.
JavaScript Exploits Explained: How They Work and How to Stop Them
A practitioner's tour of the JavaScript exploit classes that actually break production apps — prototype pollution, XSS, and malicious dependencies — with detection and fixes.
How to Fix Cross-Site Scripting Vulnerabilities in Java (With Examples)
A practical walkthrough of how to fix cross site scripting vulnerabilities in Java: context-aware output encoding, template auto-escaping, and where servlet code goes wrong.
Showdown Markdown Converter: XSS Risks and Safe Configuration
The npm showdown library converts Markdown to HTML without sanitizing it — by design. Here is where the XSS risk actually lives and how to render untrusted Markdown safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.