xss
Safeguard articles tagged "xss" — guides, analysis, and best practices for software supply chain and application security.
86 articles
JavaScript Exploits Explained: How They Work and How to Stop Them
A practitioner's tour of the JavaScript exploit classes that actually break production apps — prototype pollution, XSS, and malicious dependencies — with detection and fixes.
How to Fix Cross-Site Scripting Vulnerabilities in Java (With Examples)
A practical walkthrough of how to fix cross site scripting vulnerabilities in Java: context-aware output encoding, template auto-escaping, and where servlet code goes wrong.
Showdown Markdown Converter: XSS Risks and Safe Configuration
The npm showdown library converts Markdown to HTML without sanitizing it — by design. Here is where the XSS risk actually lives and how to render untrusted Markdown safely.
TinyMCE npm Security: XSS History and Safe Configuration
The tinymce npm package is a capable rich-text editor with a long history of XSS advisories. Keeping it current and configuring it defensively is what keeps it safe.
Local Storage Security: What to Store and What Never To
Local storage security comes down to one rule most apps break: the browser's localStorage is readable by any JavaScript on the page, so it is no place for secrets.
What Is a Cross-Site Scripting Vulnerability, and How Do You Fix It?
A cross-site scripting vulnerability lets an attacker run their JavaScript in your users' browsers, and you fix it by encoding output and validating input at the right boundaries.
jQuery 3.6.0 Vulnerabilities: What Is Actually Exploitable
Scanners keep flagging jQuery 3.6.0 as vulnerable — but jQuery core in that version has no known direct CVEs. Here is what the alerts really mean and where the exploitable risk actually lives.
JavaScript Security Issues: Common Risks and How to Fix Them
The JavaScript security issues that bite most teams are XSS, prototype pollution, vulnerable npm dependencies, and leaked secrets. Here is how each works and how to fix it.
Is turndown on npm Safe? A Security Review
turndown converts HTML to Markdown with no known CVEs, but the real risk is what you do with its input and output. Here is how to use it safely.
jQuery UI 1.12.1 and 1.13.1 Vulnerabilities: CVE Guide
jQuery UI 1.13.1 vulnerabilities come down to one checkboxradio XSS, while 1.12.1 carries four. A practical guide to the CVEs, exploit conditions, and the upgrade to 1.13.2+.
CSP Meaning in Security: What Content Security Policy Actually Does
CSP in security stands for Content Security Policy, a browser mechanism that tells the page which sources of script, style, and other content it may trust. Here is what it means and how to use it.
How to Validate a URL in JavaScript Without Opening a Hole
The modern way to validate a URL in JavaScript is the built-in URL constructor, not a regex. Here's how to use it safely on both the client and the server.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.