Application Security
WebSocket Security in Modern Applications
WebSockets enable real-time communication but introduce attack surfaces that traditional HTTP security controls miss entirely.
Apr 8, 20245 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
WebSockets enable real-time communication but introduce attack surfaces that traditional HTTP security controls miss entirely.
Prototype pollution lets attackers modify the behavior of all JavaScript objects by injecting properties into Object.prototype. This guide covers exploitation techniques, real-world impact, and layered defenses.
Service workers intercept network requests, cache content, and run in the background. When compromised, they become a persistent foothold in the browser.
Remix's server-first architecture and loader/action primitives make for a distinctive security model. The framework encourages good patterns, but the places where it leaves choices to the developer are where I find the interesting bugs.
Privilege escalation vulnerabilities let attackers elevate their access level within an application. This guide covers both vertical and horizontal escalation techniques, real-world patterns, and concrete defenses.
HTTP request smuggling exploits disagreements between frontend and backend servers about where one request ends and the next begins. This guide covers CL.TE, TE.CL, and TE.TE variants with detection and defense strategies.
PWAs blur the line between websites and applications. Their security model is browser-based, which introduces different risks than native applications.
Authorization flaws let authenticated users access resources and perform actions beyond their intended permissions. Learn the most common authorization vulnerabilities and how to build robust access control systems.
Cache poisoning attacks manipulate web caches to serve malicious content to other users. This guide covers web cache poisoning, DNS cache poisoning, and practical defenses for modern applications.
Weekly insights on software supply chain security, delivered to your inbox.