AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
306 articles
What Is a PHP Security Scanner and Which One Should You Use?
A PHP security scanner inspects your code and dependencies for injection flaws, insecure configuration, and known CVEs. Here is how the different tool classes work and where each fits.
Static Code Analysis Tools: The Open Source Options
Static code analysis tools open source teams actually use — Semgrep, CodeQL, Bandit, ESLint security plugins — and where each one's coverage runs out.
SAST Scans Explained: How Static Analysis Finds Code Flaws
SAST scans read your source code without running it, tracing untrusted data from input to sink to catch injection and other flaws before they ship.
SAST vs DAST: When to Use Each (and Why Not Either/Or)
SAST and DAST test different layers of an application at different stages of the pipeline — the real question isn't which to pick, it's how to run both without duplicating effort.
OSS Scan: How to Scan Open Source Dependencies for Vulnerabilities
An OSS scan finds known vulnerabilities in the open source packages your code depends on. Here is how the scan works, where it fits in CI, and how to act on results.
JavaScript Injection Attacks: Types and Prevention
JavaScript injection covers a family of attacks where untrusted input becomes executable code or markup in the browser. Here are the types and the concrete defenses for each.
LDAP Injection Attacks: How They Work and How to Prevent Them
LDAP injection lets an attacker manipulate directory-service queries by inserting special filter characters into user input, often bypassing authentication entirely — here's how the attack works and how to stop it.
SAST and DAST Full Form: What the Acronyms Actually Mean
The SAST and DAST full form is Static and Dynamic Application Security Testing. Here is what each one does, where they differ, and when to use both.
What Is vm2? The Node.js Sandbox and Its Security History
vm2 was the most popular way to run untrusted JavaScript inside Node.js — until a string of sandbox-escape CVEs and its 2023 deprecation showed why sandboxing a dynamic language is so hard to get right.
Stored XSS Explained: A Security Guide
Stored XSS is the persistent, high-impact form of cross-site scripting where a malicious script is saved server-side and served to every visitor. Here is how to detect and stop it.
X.509 Certificates in .NET: System.Security.Cryptography Explained
A practitioner's tour of System.Security.Cryptography.X509Certificates: loading certs safely on modern .NET, chain validation, stores, and the mistakes that quietly disable TLS security.
Why We Use CORS in Node.js: Configuration Without the Foot-Guns
Understanding why we use CORS in Node.js starts with what it is not: CORS is a browser relaxation mechanism, not a security wall. Here is how to configure it in Express without the classic misconfigurations.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.