Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
ASVS V3.3.4 (Level 2) says session tokens and similar cookies need HttpOnly and must travel only in Set-Cookie. Here is how to set it, prove it, and avoid the usual leaks.
ASVS 5.0 V3.3.3 (Level 2) requires the __Host- cookie prefix unless a cookie is meant to be shared across hosts. What it enforces and how to verify it.
ASVS 5.0 V3.3.2 (Level 2) requires a SameSite value matched to each cookie's purpose to limit CSRF and UI redress. Which value to use, and how to test.
ASVS 5.0 V3.3.1 (Level 1) requires the Secure attribute on cookies, with a __Host- or __Secure- name prefix. Express, Django and Spring settings and tests.
ASVS 5.0 V3.2.3 (Level 3) requires code that resists DOM clobbering: explicit declarations, type checks, no globals on document, namespaces. How to test.
ASVS 5.0 V3.2.2 (Level 1) requires safe DOM functions for text content. Replace innerHTML with textContent, handle framework escape hatches, and test for XSS.
ASVS 5.0 V3.2.1 (Level 1) requires controls so APIs and uploads are not rendered as pages. Headers to set, Sec-Fetch checks and a quick test.
ASVS 5.0 V3.1.1 (Level 3) requires documentation of the browser security features you depend on and what happens when they are missing. A template.
ASVS 5.0 V2.4.2 (Level 3) asks business flows to reject transactions submitted faster than a person could. A server side timing check and a test.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
