Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
In software engineering and security, the SCA full form is Software Composition Analysis: the practice of inventorying and vetting the open-source components your code depends on.
A walk through the real npm sanitize-html vulnerabilities, from the 2016 recursion bypass to the 2024 style-attribute leak, and the configuration that keeps the library safe.
The cookie-parser npm middleware is deceptively simple, but signed-cookie misuse and a 2024 CVE in its underlying cookie library still catch Express teams out.
To scan web applications well you need the right tool for the right layer. Here is what a web scan actually catches, where each type falls short, and how to combine them.
A defender's MySQL injection cheat sheet: the query patterns attackers probe for, how login bypass and UNION-based extraction work, and how to shut them down.
A secret scan finds hardcoded credentials, API keys, and tokens in your code and history before an attacker does. Here is how to scan, what to catch, and how to respond.
SAST in DevSecOps means catching code-level flaws before they merge, not after they ship. Here is how to integrate static analysis so developers actually use it.
Secure code scanning finds vulnerabilities in source and dependencies before they ship. Here is how SAST, SCA, and secret scanning fit together in CI.
Web session security is the set of controls that keep a logged-in user's session token from being stolen, guessed, or reused by an attacker — and most of it comes down to a handful of cookie flags and lifecycle rules teams routinely skip.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
