Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A symlink inside a zip or tar can point at any file on your server. Reject archives with symlinks unless you truly need them, and allowlist targets if you do.
A single user should not be able to fill your storage. Enforce a byte quota and a file count per user, and make the check atomic under concurrency.
Zip bombs are tiny files that expand to gigabytes. Check total uncompressed size and file count before you extract anything, and keep counting while you do.
A file named photo.png may be anything. Check the extension against an allowlist and verify the content matches, using magic bytes, parsers or image re-encoding.
Accept only file sizes your app can process without slowing down or falling over. Enforce limits at the edge, in the framework and while streaming.
Write down permitted file types, extensions, maximum sizes including unpacked size, and what happens to a malicious file for every upload feature.
Get the WebSocket token from an already authenticated HTTPS session, never from the socket itself. A short walk through the exchange and how to test it.
If normal session handling cannot cover your WebSocket, issue a dedicated token that meets session management rules. Here is a safe short lived design.
Browsers do not apply the same origin policy to WebSockets. Check the Origin header on the handshake against an allowlist to stop cross site hijacking.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
