AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
DAST Tools for DevSecOps Teams
The best DAST tools for DevSecOps teams run inside CI/CD rather than as a separate pre-launch step, and Gartner's own analysis of the DAST market backs that shift as the defining trend.
What SCA Means in Security (Software Composition Analysis)
The SCA security meaning explained: what software composition analysis is, how it differs from SAST and DAST, and why it matters for the open source in your code.
What Is a Mend Scan and How Does It Work?
A Mend scan analyzes your open-source dependencies and code for known vulnerabilities and license risk. Here is what it covers and how to run one in CI.
The OWASP API Security Top 10: Each Risk Explained
The OWASP API Top 10 is a ranked list of the most common API-specific vulnerability classes, from broken object level authorization to unsafe consumption of third-party APIs.
nimbus-jose-jwt: JWT Handling in Java Done Right
com.nimbusds:nimbus-jose-jwt is the JVM's workhorse JOSE library. Here is how to configure it so algorithm confusion, weak validation, and its one recent CVE never reach production.
jwt-decode: Why Decoding Is Not Verifying (Security Guide)
The npm jwt-decode package reads JWT claims without checking the signature. That is by design, and it is behind a whole class of authentication bypasses when developers forget it.
How a Web Application Penetration Test Actually Works (and What It Finds)
A web application penetration test simulates a real attacker against your app. Here is what the phases look like and how to act on the report.
DAST Testing: How Dynamic Scans Probe Running Applications
DAST testing attacks your app the way an outsider would — no source code, just HTTP requests against a running target. Here is how the scan works, what it catches that SAST misses, and where it falls short.
What Is a White Box Penetration Test?
A clear explanation of the white box penetration test: how full-knowledge testing differs from black and gray box, what testers get, and when it is the right choice.
PDFKit v0.8.6 Command Injection (CVE-2022-25765): Detection and Fix
The pdfkit v0.8.6 exploit is CVE-2022-25765, a command injection in the Ruby pdfkit gem where an unsanitized URL reaches the shell. How it works conceptually, how to detect it, and the fix.
Python: Check If a String Is a Valid URL (Safely)
How to check if a string is a URL in Python using urllib.parse, when to add validators, and why parseable does not mean safe for the URL you are about to fetch.
Uncaught Exceptions in JavaScript: Handling Them Without Hiding Bugs
A JavaScript uncaught exception is a thrown error that no catch block claims — and the worst response is a global handler that swallows it. Here is how to handle them in Node and the browser without hiding real bugs.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.