Security Guides
OAuth state vs nonce vs PKCE: what does each one stop?
State, nonce and PKCE look alike but guard different attacks. A plain guide to which one blocks CSRF, ID token replay and authorization code injection.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
How long should an OAuth authorization code live, and why once?
RFC 6749 says codes must expire shortly, with a maximum of 10 minutes recommended, and be used once. What reuse means and how a server should respond.
Oct 19, 20264 min read
Security Guides
What if encryption at rest is infeasible under NYDFS 500.15?
NYDFS 500.15 requires encryption in transit and at rest, with CISO-approved compensating controls if at-rest is infeasible.
Oct 19, 20263 min read
Security Guides
Does npm run build also run prebuild and postbuild scripts?
Yes. npm runs a matching pre and post script around any script you run, so a build can execute more commands than the one you typed. Here is how to check.
Oct 19, 20264 min read
Security Guides
Notify, fix, publish: the three SLA clocks in vendor vulnerability response
A vendor vulnerability SLA is really three clocks: tell customers, ship a fix, publish the record. How to define each, who owns it, and when it starts.
Oct 19, 20264 min read
Security Guides
Can a flaw be not affected in one environment and affected in another?
Yes. Configuration, build flags and exposure differ by deployment. How to record per deployment exploitability with VEX status and justifications.
Oct 19, 20264 min read
Security Guides
Nonce or hash: which CSP method fits a cached store page?
Nonces need a fresh value on every response, which clashes with page caching. Compare nonce and hash CSP methods for a busy storefront and pick one.
Oct 19, 20264 min read
Security Guides
What do Node.js headersTimeout and requestTimeout do against slow clients?
Node's HTTP server sets headersTimeout, requestTimeout and keepAliveTimeout by default. See the documented values and when to tighten them for slow clients
Oct 19, 20263 min read
Security Guides
Which Node.js hardening flags exist, and what does each one do?
A reference table of Node.js runtime flags that reduce attack surface: disable-proto, no-addons, code generation limits, secure heap and frozen intrinsics.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.