xss
Safeguard articles tagged "xss" — guides, analysis, and best practices for software supply chain and application security.
86 articles
PHP Application Security: A Practical Guide to Locking Down Your Code
PHP application security comes down to a handful of high-impact controls. Here is how to handle injection, sessions, uploads, and dependencies without the theory.
JavaScript Injection Attack: How It Works and How to Stop It
A JavaScript injection attack runs attacker-controlled script in a victim's browser or a Node.js process. Here is how the attack class works and the defenses that actually neutralize it.
npm rollup: A Security Review and Safe Usage Guide
A practical look at what installing rollup from npm means for your supply chain, the DOM clobbering XSS bug you should know about, and how to pin a safe version.
jQuery Validation: A Security Guide to XSS and ReDoS Risks
The jQuery Validation plugin is convenient, but client-side validation is not a security control. Here is where jquery validation has been vulnerable and how to use it safely.
What jQuery Migrate Is and How to Use It Securely
jQuery Migrate helps older code survive newer jQuery releases, but leaning on it can quietly keep you on a vulnerable jQuery version. Here is how to use it without inheriting old XSS bugs.
Is react-json-view Safe to Use? A Security Guide
The original react-json-view package is popular but unmaintained. Here is what that means for your app's security and which fork to move to.
Is swagger-ui-react Safe? A Security Guide for React API Docs
swagger-ui-react has no known direct CVEs, but its real risk lives in a deep dependency tree. Here is how to embed it without inheriting a transitive XSS.
org.owasp.esapi: What the OWASP ESAPI Library Is and How to Use It Safely
org.owasp.esapi is the Maven coordinate for OWASP ESAPI, a Java security control library. Here is what it does, where it still helps, and the CVEs to watch.
Bootstrap 4.3.1 and 4.4.1 Vulnerabilities: Audit and Upgrade Guide
What your scanner means when it flags bootstrap 4.3.1 vulnerabilities: the real advisories, the withdrawn one, the jQuery 3.4.1 problem next to it, and a sane upgrade path.
What is Cross-Site Scripting (XSS)
XSS lets attackers inject malicious JavaScript into trusted pages. Learn how stored, reflected, and DOM-based XSS work, real breaches, and defenses.
react-number-format: A Security Guide for Safe Input Handling
react-number-format is a popular library for formatting numeric and masked inputs. Here is how to use it without opening XSS or validation gaps.
marked on npm: Security Review and Safe Usage
marked is a fast Markdown parser, but it does not sanitize output and older versions carried a ReDoS bug. Here is how to use marked npm without opening an XSS hole.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.