Security Guides
JWT validation checklist for API servers, based on RFC 8725
A checklist for what an API must verify on every JWT: algorithm, signature, issuer, audience, expiry and type. Based on RFC 8725 and OWASP guidance.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
JWT myths vs facts: signed, encrypted, safe and stateless
Five common beliefs about JWTs in APIs, checked against RFC 8725 and OWASP guidance: the none algorithm, header trust, expiry, revocation and secrets.
Oct 18, 20263 min read
Security Guides
JWT kid, jku and x5u headers: how to validate without SSRF or injection
Header fields in a JWT are attacker controlled. RFC 8725 says to sanitize kid and allowlist jku and x5u. A practical validation order for your verifier.
Oct 18, 20263 min read
Security Guides
A valid JWT signature is not enough: validating iss, aud and typ
A correct signature only proves who signed a token. RFC 8725 also says to check issuer, subject, audience and token type to stop cross-service misuse.
Oct 18, 20263 min read
Security Guides
How to judge a security researcher blog post before reacting
A researcher blog can be excellent or overstated. Check for reproduction, scoped claims, vendor response and fix status before deciding it matters to you.
Oct 18, 20263 min read
Security Guides
How to judge a mobile developer tool before you install it
A short checklist for vetting a phone app that touches your code or alerts: permissions, network use, sign-in, data storage and updates, per Android docs.
Oct 18, 20264 min read
Security Guides
Jeopardy vs attack-defense CTF: which format to pick for training
Jeopardy CTFs suit most internal training; attack-defense suits mature teams with time to spare. Here is how the two formats differ and how to choose.
Oct 18, 20263 min read
Security Guides
How to prevent prototype pollution in JavaScript and Node.js
Prototype pollution lets attackers change shared object behavior. Practical defenses: Map, Object.create(null), freezing prototypes and --disable-proto.
Oct 18, 20263 min read
Security Guides
Java deserialization: allowlist filters and what they cannot fix
Reduce Java native deserialization risk with serialization filters and class allowlists, which libraries are safe by default, and why filters are no cure.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.