Application Security
ASVS 5.0 V4.4.1: Use WSS for Every WebSocket
Plain ws:// sends everything in cleartext. Use wss:// for all WebSocket connections and make your server and clients refuse the unencrypted form.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V4.3.2: Disable GraphQL Introspection in Production
Introspection hands attackers your full schema. Turn it off in production unless the API is public by design, and test that suggestions do not leak it back.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V4.3.1: Limit GraphQL Query Depth and Cost
One nested GraphQL query can pull millions of rows. Use an allowlist, depth limits, amount limits or cost analysis to stop query based denial of service.
Oct 18, 20265 min read
Application Security
ASVS 5.0 V4.2.5: Keep Outbound URIs and Headers Short
If your app builds requests, cap the length of URIs and headers such as Cookie so a long value cannot lock users out with permanent errors.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V4.2.4: Reject CR and LF in HTTP/2 and 3 Headers
Header names and values in HTTP/2 and HTTP/3 must never contain CR or LF. Reject them on input to block header injection and smuggling after downgrade.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V4.2.3: No Connection Headers in HTTP/2 or HTTP/3
HTTP/2 and HTTP/3 forbid connection specific headers such as Transfer-Encoding. Reject them on input and never emit them on output.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V4.2.2: Generate Correct Content-Length Headers
When your code builds HTTP messages, Content-Length must never disagree with the real body length. Learn how to avoid it and test for mismatches.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V4.2.1: Prevent HTTP Request Smuggling
Every proxy and server in the chain must agree on where an HTTP message ends. Learn the Transfer-Encoding and Content-Length rules and how to test them.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V4.1.5: Sign Sensitive Messages Beyond TLS
For highly sensitive or multi hop requests, add a per message signature on top of TLS. See when it applies and how to sign and verify safely.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.