AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
306 articles
GitLab IaC Scanning: How to Catch Misconfigured Infrastructure
GitLab IaC scanning checks Terraform, Kubernetes, and CloudFormation for insecure settings before they deploy. Here is how to turn it on and make the results actionable.
AppSec Vulnerability Management: A Workflow Guide
A step-by-step appsec vulnerability management workflow for teams drowning in scanner output — from intake and triage through prioritization, remediation, and verification.
Secure Code Review: A Practical Checklist
Secure code reviews catch a different category of bug than functional code review, and having a repeatable checklist keeps reviewers from relying on memory for the same handful of recurring flaws.
Mobile Security Testing for iOS and Android Apps
Mobile apps fail in ways web apps don't — insecure local storage, weak certificate pinning, reverse-engineerable binaries — and testing them requires methods most web-focused AppSec programs never built.
Does Snyk Offer IAST? Interactive Testing and the Alternatives
People searching for Snyk IAST are usually asking whether Snyk does interactive application security testing. Here is the honest answer and how IAST fits alongside Snyk's actual strengths.
SAST Vendors Compared: How to Choose a Static Analysis Tool
Choosing among SAST vendors comes down to language coverage, false-positive rate, developer workflow fit, and how the results reach the people who fix code.
SQL Injection Commands Explained: How the Attack Works and How to Stop It
Understanding the SQL injection commands attackers rely on is the fastest way to learn how to defend against them. This guide explains the classes conceptually and focuses on detection and remediation.
Python 2 vs Python 3: Differences and Why 2.x Is a Security Liability
The real differences between Python 2 and Python 3 — print, strings, division, integers — and why running anything on 2.x after its end of life is now a security decision, not a compatibility one.
SAST, DAST, and IAST: The Three Application Testing Types
SAST DAST IAST are three distinct testing approaches that catch different bug classes at different stages — here's how each actually works and when to run which.
OWASP API Top 10 2023: What Changed and How to Defend
The OWASP API Security Top 10 2023 puts authorization failures at the top and adds new risks around business flows and API consumption. Here's the full list with defenses.
An OWASP-Aligned Secure Code Review Checklist
OWASP's secure code review guidance gives structure to what could otherwise be an unfocused read-through — here's a practical checklist built around it.
Code Quality Scan: What It Catches and Where It Stops
A code quality scan flags maintainability and reliability issues in your source, but it is not a security scan. Here is what each type finds and how to run both without noise.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.