Application Security
How do you stop XSS in a Kotlin web app (Spring, Ktor)?
Kotlin null safety does not prevent XSS. Keep escaping on in Thymeleaf and HTML builders, avoid unescaped output, encode by context, and add a CSP.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Can a C or C++ web app have XSS, and how do you stop it?
C and C++ services that emit HTML have no automatic escaping unless a template layer adds it. How to find unsafe output paths and encode by context.
Oct 18, 20264 min read
Application Security
How do you prevent XSS in ASP.NET Core and C# web apps?
Razor encodes output by default. XSS in C# apps comes from bypassing it, from untrusted data in scripts and from APIs returning markup. How to find and fix each.
Oct 18, 20264 min read
Application Security
What is XPath injection and how do you find it in code review?
XPath injection lets crafted input change a query on XML data. See a constructed login bypass, the code smells to grep for, and how to fix it properly.
Oct 18, 20264 min read
Application Security
How do you write tests in Python using doctest?
Doctest runs the examples in your docstrings and checks the output. Learn the syntax, the ELLIPSIS option, how to run it and where it stops being enough.
Oct 18, 20265 min read
Application Security
WireGuard vs OpenVPN: which VPN protocol fits your network?
WireGuard is small, fast and UDP only. OpenVPN is older, flexible and can run over TCP. Compare design, limits and the cases where each one fits.
Oct 18, 20264 min read
Application Security
Is vulnerability triage going away or just changing?
Triage is shifting from manual sorting to automated filtering by reachability and exploit signals. People set policy and decide the exceptions.
Oct 18, 20264 min read
Application Security
Why do you need cloud security if the provider secures the cloud?
Providers secure the infrastructure, but you secure your data, identities and settings. See where the line sits and five common gaps in cloud setups.
Oct 18, 20264 min read
Application Security
Why does vulnerability management fall short for application security?
Classic vulnerability management counts CVEs on hosts. App risk lives in code paths and dependencies. Here is the gap and how context closes it.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.