Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
ASVS V3.6.1 (Level 3): external scripts, styles and fonts must be static, versioned and covered by SRI, or have a documented decision. Generate hashes, automate checks, test.
ASVS V3.5.8 (Level 3): authenticated images, scripts and documents should load only when intended, using Sec-Fetch checks or Cross-Origin-Resource-Policy. Config and tests.
ASVS V3.5.7 (Level 3) says JavaScript files must not carry data that needs authorization, or any site can include them and read it. Patterns to avoid, fixes and tests.
ASVS V3.5.6 (Level 3) says JSONP must not be enabled anywhere, to prevent cross-site script inclusion. What JSONP is, how to find it, and the CORS replacement.
ASVS V3.5.5 (Level 2) says drop postMessage events from untrusted origins or with invalid syntax. Safe listener and sender code, tests, and the mistakes behind real bugs.
ASVS V3.5.4 (Level 2) says apps with different trust levels belong on different hostnames so same-origin policy and cookie scoping protect them. Layout, config and tests.
ASVS V3.5.3 (Level 1): sensitive functionality must not hang off GET, HEAD or OPTIONS, or must validate Sec-Fetch headers. Examples and how to test method handling.
ASVS V3.5.2 (Level 1): if CORS preflight protects your API, an attacker must not be able to reach it with a simple request. Check Content-Type and Origin. Code and tests.
ASVS V3.5.1 (Level 1) says state changing requests need anti-forgery tokens or a custom header check if you do not rely on CORS preflight. Code for Express, Django and Spring.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
