Application Security
In-depth guides and analysis on application security from the Safeguard engineering team.
100 articles
Which port does TLS use, and is there a separate SSL port?
There is no single TLS port. HTTPS uses 443, and mail, DNS, LDAP and MQTT each have their own. Here is the list, plus how to audit what your hosts expose.
When should you use Java DTOs, and do they make an API safer?
Use a Java DTO at every API boundary so callers can only set fields you allow. Records keep it short. DTOs stop mass assignment, not missing authorization.
What should modern application security testing cover?
Modern application security testing layers threat modeling, code scans, dependency and secrets checks, and runtime tests. Here is what to cover first.
What makes a firewall strong in practice?
A strong firewall is defined by its rule set, patching, management access and logs, not its feature list. Use this review to find the weak points in yours.
What is extended detection and response (XDR), and is it standardized?
XDR is a market term for detection that spans endpoints and other sources, not a defined standard. See what it usually means and what to ask a vendor.
What is workload identity, and why replace static keys with it?
Workload identity gives software its own verifiable identity and short-lived credentials, so services stop sharing long-lived keys. Here is how it works.
What is web scraping and how do sites defend against it?
Web scraping is automated collection of site content. Sites can rate limit, require login and monitor traffic, but robots.txt is not access control.
What is WAAP, and does it replace a web application firewall?
WAAP extends a web application firewall to cover APIs, bots and abuse. See what it blocks, which API risks it cannot fix, and how to test before enforcing.
What is virtual patching and when is it enough?
Virtual patching blocks exploit traffic with a rule while you prepare the real fix. It buys time for known flaws but never replaces patching the code.
What is TLS offloading and when is it safe to use?
TLS offloading ends encryption at a proxy so back ends skip the work. It is safe only if the hop behind it is trusted, isolated or encrypted again.
What is single sign-on and what can go wrong with it?
Single sign-on lets one login reach many apps through signed assertions from an identity provider. Check audience, replay, injection and session ending.
What is serverless computing and what changes for security?
Serverless runs your code on demand without you managing servers. The provider secures the host, but your code, permissions and inputs still need care.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.