Compliance
Does Socket.dev store or upload your source code?
Does Socket.dev see your proprietary source code? Here's how dependency scanners access repos, and where Safeguard draws the compliance line.
May 12, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAppSec
DAST Testing: How Dynamic Scans Probe Running Applications
DAST testing attacks your app the way an outsider would — no source code, just HTTP requests against a running target. Here is how the scan works, what it catches that SAST misses, and where it falls short.
May 11, 20267 min read
AppSec
What Is a White Box Penetration Test?
A clear explanation of the white box penetration test: how full-knowledge testing differs from black and gray box, what testers get, and when it is the right choice.
May 11, 20267 min read
AppSec
PDFKit v0.8.6 Command Injection (CVE-2022-25765): Detection and Fix
The pdfkit v0.8.6 exploit is CVE-2022-25765, a command injection in the Ruby pdfkit gem where an unsanitized URL reaches the shell. How it works conceptually, how to detect it, and the fix.
May 11, 20266 min read
Concepts
What Is Password Salting? Why Two Identical Passwords Should Never Match
Password salting adds a unique random value to each password before hashing, so identical passwords produce different hashes and precomputed attacks fall apart.
May 11, 20266 min read
AppSec
Python: Check If a String Is a Valid URL (Safely)
How to check if a string is a URL in Python using urllib.parse, when to add validators, and why parseable does not mean safe for the URL you are about to fetch.
May 11, 20266 min read
Open Source
react-native-inappbrowser-reborn: A Security Review of the In-App Browser Package
A practitioner's security look at react-native-inappbrowser-reborn: what it does, where the risk lives, and how to vet it and siblings like react-native-wifi-reborn.
May 11, 20266 min read
DevSecOps
netty-codec-http2 in Maven: Vulnerabilities and Fixes
The netty-codec-http2 Maven artifact powers HTTP/2 in gRPC, Spring, and countless services. Here are the CVEs that matter, the safe versions, and how to find it in your tree.
May 11, 20266 min read
Governance
Writing an Open Source Software Policy
An open source software policy is what turns ad-hoc dependency choices into a governed, auditable process — here's what to actually put in one.
May 11, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.