Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
com.nimbusds:nimbus-jose-jwt is the JVM's workhorse JOSE library. Here is how to configure it so algorithm confusion, weak validation, and its one recent CVE never reach production.
The npm jwt-decode package reads JWT claims without checking the signature. That is by design, and it is behind a whole class of authentication bypasses when developers forget it.
A web application penetration test simulates a real attacker against your app. Here is what the phases look like and how to act on the report.
DAST testing attacks your app the way an outsider would — no source code, just HTTP requests against a running target. Here is how the scan works, what it catches that SAST misses, and where it falls short.
A clear explanation of the white box penetration test: how full-knowledge testing differs from black and gray box, what testers get, and when it is the right choice.
The pdfkit v0.8.6 exploit is CVE-2022-25765, a command injection in the Ruby pdfkit gem where an unsanitized URL reaches the shell. How it works conceptually, how to detect it, and the fix.
How to check if a string is a URL in Python using urllib.parse, when to add validators, and why parseable does not mean safe for the URL you are about to fetch.
A JavaScript uncaught exception is a thrown error that no catch block claims — and the worst response is a global handler that swallows it. Here is how to handle them in Node and the browser without hiding real bugs.
DAST scanning tools test a running application from the outside to find runtime flaws. Here is how they work, what they catch, and how to pick one.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
