Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Application security protects the code and apps you build. Product security is wider: the shipped product, vulnerability disclosure and advisories.
Keep untrusted data out of HTML sinks, let the framework encode, sanitize what you must allow, and enforce it with Trusted Types. A TypeScript checklist.
Prevent XSS in server-side Swift by rendering through an auto-escaping template engine like Leaf, avoiding unsafeHTML, validating URLs and adding a CSP.
Twirl templates in Play escape output by default, but Html wrapping, string interpolation and unchecked URLs bring XSS back. Here is what to review.
Turn on template autoescaping, review every safe filter, and encode by context for attributes, URLs and script data. Examples for Django and Jinja.
Encode every variable for the context it lands in, use htmlspecialchars with explicit flags and UTF-8, sanitize user HTML with a library, and add a CSP.
Phoenix escapes template output by default, but raw, unsafe URLs and script contexts bypass it. Learn which escape hatches to grep for and review.
Use html/template, never text/template, for HTML. Avoid the typed escape hatches, treat JS and URL values with care, and add a CSP. A Go review checklist.
Use parameterized queries for every value, map dynamic identifiers to allow-lists, run the app with a least-privilege database user, and keep types honest at runtime.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
