AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
Vulnerability Scanners and the Gartner AST Landscape: How the Tools Actually Work
When people search for a vulnerability scanner in the Gartner sense, they usually mean the AST market. Here is what that market covers, how the tool types work, and how to choose.
Black Box Fuzzing, Explained
Black box fuzzing throws malformed input at a running application with zero knowledge of its internals, and it still finds crashes and memory bugs white box testing misses — here's how it works and where it fits in a security program.
ZAP Scanner: How OWASP ZAP Works and When to Use It
ZAP is the most widely used free DAST scanner. Here is how its spider, passive, and active engines work, where it fits in CI, and its honest limits.
XSS Code Examples: How Cross-Site Scripting Looks in Practice
An XSS code example makes the abstract concrete: here is what vulnerable code looks like for each type of cross-site scripting, and the small change that fixes each one.
Mobile Security Testing: OWASP MAS in Practice
OWASP MAS turns mobile app security from ad-hoc pentests into a program: what the eight MASVS control groups cover, how MASTG test cases work, and how to fit it all into CI.
Web Application Scanning: Tools and Methods Compared
Web application scanning ranges from free automated crawlers to full authenticated DAST pipelines — here's how the methods differ and when each is enough.
Dynamic Scanning, Explained for Engineers Who Aren't Security Specialists
Dynamic scanning tests a running application the way an attacker would, by sending it requests and watching what comes back. Here's what that actually involves and when it's the right tool.
Python Vulnerability Scanner: How It Works and What to Use
A Python vulnerability scanner checks your code and dependencies for known security flaws. Here is how the different scanner types work and how to combine them in CI.
What Is an SSRF Attack? Examples and How to Stop It
An SSRF attack tricks your server into making requests on an attacker's behalf, often reaching internal systems it should never touch. Here is how it works and how to defend against it.
Skill Scanner: How It Works and What to Use
What a skill scanner does, why AI agent skills and voice-assistant skills need scanning, and how to evaluate one for your pipeline.
SCA Solution: How to Choose Software Composition Analysis
An SCA solution inventories your open-source dependencies and flags the ones with known vulnerabilities or risky licenses. Here is what separates a good one.
Mobile Application Penetration Testing: A Practical Guide
How mobile application penetration testing actually works — the methodology, the tools, and what to expect from a good engagement — from someone who runs them.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.