AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
What Tree-sitter Taint Analysis Actually Catches (and What It Cannot)
Following untrusted data from source to sink across a real codebase is a solved problem right up until reflection, dynamic dispatch and an ORM turn up. Knowing where the analysis stops is what makes it usable.
Recall Is Easy. Your SAST Tool's Real Metric Is the Mute Rate
Any scanner can find every vulnerability by flagging everything. The number that decides whether a tool survives contact with a development team is how often it is wrong.
Running the OWASP Benchmark Against Your Own SAST Engine
A scanner with no measured accuracy is a scanner with claimed accuracy. Wiring up the OWASP Benchmark gives you one number that survives scrutiny — and usually finds a crash on the way.
How to Read a Security Scanning Report Without Drowning in Noise
A security scanning report lists what a scanner found across your code, dependencies, and infrastructure. Here's how to read one, prioritize it, and act on what matters.
VAPT Tools: The Vulnerability Assessment and Penetration Testing Toolkit
VAPT tools are the software used to run vulnerability assessment and penetration testing. Here is what belongs in the toolkit, how the categories differ, and how to pick the right tool for the job.
Code Security Scanners: Choosing One for Your Stack
The right code security scanner depends less on which vendor's marketing sounds best and more on language coverage, false-positive rate, and whether it fits into the workflow developers already use.
Code Security Scan: How to Scan Your Code for Vulnerabilities
A code security scan analyzes your source and its dependencies for security flaws before they ship. Here is how the main scan types work, what tools to use, and how to wire scanning into CI without drowning in noise.
SAST Tooling: How to Choose and Run Static Analysis That Developers Trust
SAST tooling scans your source code for security flaws before it runs, but the tool you pick matters less than how you tune it. Here is how to choose, integrate, and keep the noise down.
Choosing a Secrets Scanning Tool That Actually Catches Leaks
A secrets scanning tool finds API keys, tokens, and passwords hiding in your code and git history. Here is how they work and what to look for in one.
SCA and Application Security: How Software Composition Analysis Fits In
SCA application security is about finding and fixing risk in the open-source code you depend on. Here is where it fits alongside SAST and DAST.
SQL Injection Cheatsheet: Detection and Prevention for Developers
A defender's SQL injection cheatsheet: how the vulnerability class works, how to recognize it in code, and the patterns that reliably shut it down.
The Benefits of Using SAST Tools During Code Review
The real benefit of using SAST tools during code review isn't finding more bugs than a human reviewer — it's finding the specific bugs humans consistently miss, before merge.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.