Application Security
ASVS 5.0 V4.1.4: Allow Only the HTTP Methods You Use
Every route should accept an explicit list of HTTP methods and reject the rest with 405. Here is how to set it up and prove it works.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V4.1.3: Stop Users Overriding Proxy Headers
Headers like X-Forwarded-For and X-User-ID set by a proxy must not be forgeable by clients. Strip them at the edge and trust only your own hops.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V4.1.2: Redirect HTTP to HTTPS for Browsers Only
Only endpoints meant for browsers should redirect HTTP to HTTPS. API endpoints should refuse plain HTTP so a misconfigured client fails loudly.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V4.1.1: Send an Accurate Content-Type With a Charset
ASVS V4.1.1 (Level 1): every response with a body needs a Content-Type that matches the content, with a charset for text, XML and similar types. Config and tests.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V3.7.5: Define What Happens on Browsers Missing Security Features
ASVS V3.7.5 (Level 3) says the app must behave as documented, by warning or blocking, when a browser lacks expected security features. Detection code and test steps.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V3.7.4: Add Your Domain to the HSTS Preload List
ASVS V3.7.4 (Level 3) requires your top-level domain on the HSTS preload list so browsers enforce TLS from the first visit. Prerequisites, header, submission and removal risks.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V3.7.3: Warn Users Before Sending Them Off Your Site
ASVS V3.7.3 (Level 3) wants a notification, with a way to cancel, when a user is redirected to a URL outside your control. Interstitial design, code and tests.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V3.7.2: Redirect Only to Allowlisted External Hosts
ASVS V3.7.2 (Level 2): automatic redirects to hosts you do not control must hit an allowlist. Open redirect examples, safe code for Express and Django, and tests.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V3.7.1: Drop Flash, Silverlight, Java Applets and Other Plugins
ASVS V3.7.1 (Level 2) bans client-side technologies that are unsupported or insecure, such as Flash, ActiveX and Java applets. How to find leftovers and replace them.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.