Application Security
In-depth guides and analysis on application security from the Safeguard engineering team.
490 articles
The One Line of Ordinary Code That Kills a Taint Engine
param = decode(param) is as common as code gets. In a dataflow engine that resolves variables by looking backwards, it can recurse forever — and in Go the resulting stack overflow cannot be caught.
Reading an OWASP Benchmark Score Without Being Sold To
A tool that flags every test case scores 100% detection on the OWASP Benchmark. Recall is the number vendors quote and the one that means least — here is what the suite actually measures.
A Scanner's Scope Guard Belongs in Code, Not in a Config File
The difference between a security test and an unauthorised attack is permission on the target. If that boundary is a setting, then a typo, a redirect or a merged config is all it takes to cross it.
Authenticated DAST: Getting Past the Login Without Wrecking the App
Most of an application is behind a session, so an unauthenticated scan tests the login page and the marketing footer. Getting in is the easy half — staying in, and not clicking Delete Account, is the rest.
Your DAST Scan Has Six Timeouts and No Deadline
Per-phase timeouts add up. Six phases capped at ten minutes each is a sixty-minute scan wearing a ten-minute label — and the phase that mattered gets whatever is left.
Fingerprinting AI-Built Web Apps From the Outside
A DAST scan has no repository and no commit history — only what the server sends a browser. That is enough to identify the builder that generated an app, and nowhere near enough to name the model.
AI Writes Code Faster Than You Can Review It. Which Scanner Do You Point at It?
AI-generated code arrives faster than review can absorb and fails in distinct patterns. SAST, DAST, and reachability each catch part of that — and each misses a specific, predictable slice.
Your DAST Scanner Was Built to Crawl Links. Your Application Doesn't Have Any.
Classic DAST discovers attack surface by following hyperlinks. In an estate of APIs and serverless functions there is nothing to crawl, so the scan completes, reports clean, and covers little.
The Average Enterprise Runs 900 APIs. It Can List Maybe 600 of Them.
API attacks are climbing steeply and 87% of organisations reported an incident last year. The root cause is not weak authentication — it is that many production endpoints are on nobody's list.
Polymarket Lost ~$3M Without a Single Smart Contract Bug
On 25–26 June 2026 attackers compromised a third-party vendor and injected malicious code into Polymarket's website frontend, manipulating users into approving fraudulent transactions. Roughly $3M in crypto drained. The smart contracts were never touched. Your client-side dependency tree is production.
Out-of-Bounds Read Vulnerabilities (CWE-125) Explained
How out-of-bounds read vulnerabilities (CWE-125) leak memory instead of crashing programs, why Heartbleed and Cloudbleed happened, and how to catch them in your dependencies.
Finding vulnerable code hidden inside shaded and uber JARs
JFrog found 65% of Log4Shell-affected artifacts embedded raw .class files instead of a jar — invisible to scanners that only read pom.xml metadata.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.