Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
ASVS V3.4.8 (Level 3) wants Cross-Origin-Opener-Policy same-origin or same-origin-allow-popups on every document response. Why it helps, how to set it, how to test.
ASVS V3.4.7 (Level 3) says your Content-Security-Policy must name a place to send violation reports. Setup with report-to, an endpoint sketch, and how to verify it.
ASVS V3.4.6 (Level 2) requires CSP frame-ancestors on every response so pages cannot be embedded by default. X-Frame-Options alone is not enough. Config and tests.
ASVS V3.4.5 (Level 2) requires a referrer policy so paths and query strings do not leak to third parties. Header and meta examples, a test, and the traps to avoid.
ASVS V3.4.4 (Level 2) requires X-Content-Type-Options: nosniff on all responses so browsers trust your Content-Type. Config for nginx, Express and Apache, and a quick test.
ASVS V3.4.3 (Level 2) needs a CSP with object-src none and base-uri none plus an allowlist, nonces or hashes. Level 3 wants per-response nonces. How to build and test it.
ASVS V3.4.2 (Level 1) says Access-Control-Allow-Origin must be fixed or checked against an allowlist. Code for Express, Flask and nginx, plus tests for reflected origins.
ASVS V3.4.1 (Level 1) requires Strict-Transport-Security on every response with max-age of at least one year, plus includeSubDomains at Level 2. Setup and tests inside.
ASVS V3.3.5 (Level 3) caps a cookie's name plus value at 4096 bytes so browsers keep it. Here is how to enforce the limit, test it, and stop cookie bloat.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
