xss
Safeguard articles tagged "xss" — guides, analysis, and best practices for software supply chain and application security.
86 articles
TinyMCE npm Security: XSS History and Safe Configuration
The tinymce npm package is a capable rich-text editor with a long history of XSS advisories. Keeping it current and configuring it defensively is what keeps it safe.
Local Storage Security: What to Store and What Never To
Local storage security comes down to one rule most apps break: the browser's localStorage is readable by any JavaScript on the page, so it is no place for secrets.
What Is a Cross-Site Scripting Vulnerability, and How Do You Fix It?
A cross-site scripting vulnerability lets an attacker run their JavaScript in your users' browsers, and you fix it by encoding output and validating input at the right boundaries.
jQuery 3.6.0 Vulnerabilities: What Is Actually Exploitable
Scanners keep flagging jQuery 3.6.0 as vulnerable — but jQuery core in that version has no known direct CVEs. Here is what the alerts really mean and where the exploitable risk actually lives.
JavaScript Security Issues: Common Risks and How to Fix Them
The JavaScript security issues that bite most teams are XSS, prototype pollution, vulnerable npm dependencies, and leaked secrets. Here is how each works and how to fix it.
Is turndown on npm Safe? A Security Review
turndown converts HTML to Markdown with no known CVEs, but the real risk is what you do with its input and output. Here is how to use it safely.
jQuery UI 1.12.1 and 1.13.1 Vulnerabilities: CVE Guide
jQuery UI 1.13.1 vulnerabilities come down to one checkboxradio XSS, while 1.12.1 carries four. A practical guide to the CVEs, exploit conditions, and the upgrade to 1.13.2+.
CSP Meaning in Security: What Content Security Policy Actually Does
CSP in security stands for Content Security Policy, a browser mechanism that tells the page which sources of script, style, and other content it may trust. Here is what it means and how to use it.
How to Validate a URL in JavaScript Without Opening a Hole
The modern way to validate a URL in JavaScript is the built-in URL constructor, not a regex. Here's how to use it safely on both the client and the server.
node-html-parser: How to Parse HTML Safely in Node.js
node-html-parser is a fast, dependency-light HTML parser for Node.js. Here is how to use it without opening the door to injection or denial-of-service bugs.
JavaScript Injection Attacks: Types and Prevention
JavaScript injection covers a family of attacks where untrusted input becomes executable code or markup in the browser. Here are the types and the concrete defenses for each.
Stored XSS Explained: A Security Guide
Stored XSS is the persistent, high-impact form of cross-site scripting where a malicious script is saved server-side and served to every visitor. Here is how to detect and stop it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.