AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
Free Website Vulnerability Scanners: What You Actually Get
Free scanners catch the obvious stuff — missing headers, expired TLS, a handful of known CVEs — but they stop well short of what a real security program needs.
Finding Vulnerabilities in Source Code: A Practical Method
A concrete, repeatable method for finding vulnerabilities in source code — combining static analysis, dependency scanning, and manual review without drowning your team in false positives.
How to Scan Websites for Security Issues
A practical walkthrough of how to scan websites for common vulnerabilities, which tools fit which job, and how to turn scan output into fixes.
What a WhiteSource Scan Actually Checks (and How Mend Changed It)
A WhiteSource scan is a software composition analysis run that inventories your open source dependencies and flags known vulnerabilities and license risks. Here is what it looks at and how the Mend rebrand affects your pipeline.
org.owasp.esapi: What the OWASP ESAPI Library Is and How to Use It Safely
org.owasp.esapi is the Maven coordinate for OWASP ESAPI, a Java security control library. Here is what it does, where it still helps, and the CVEs to watch.
What Is the NVD (National Vulnerability Database)?
The NVD is the U.S. government's repository of analyzed vulnerability data, built on top of the CVE program — here's what it actually adds, how CVE and NVD relate, and where its data comes from.
The OWASP API Top Ten: What Every API Team Needs to Secure
A practical walkthrough of the OWASP API Top Ten (2023 edition), with the authorization, resource-consumption, and inventory gaps that actually get APIs breached.
Application Vulnerability Management: Program Basics
A working definition of application vulnerability management and the five program elements that separate a real practice from a pile of scanner tickets.
Static Source Code Analysis Tools: A Practical Guide
A practical walkthrough of what static source code analysis tools actually check, where they miss, and how to pick one without buying a shelf-ware scanner.
YAML Parsers in Java: SnakeYAML Deserialization Risks Explained
Choosing a YAML parser in Java means choosing a deserialization posture. How SnakeYAML's CVE-2022-1471 worked, what changed in 2.0, and how to parse YAML safely.
Bootstrap 4.3.1 and 4.4.1 Vulnerabilities: Audit and Upgrade Guide
What your scanner means when it flags bootstrap 4.3.1 vulnerabilities: the real advisories, the withdrawn one, the jQuery 3.4.1 problem next to it, and a sane upgrade path.
What Is a CWE? Common Weakness Enumeration Explained
What is a CWE in cyber security, how it differs from a CVE, and how the Common Weakness Enumeration turns one-off bugs into patterns you can prevent systematically.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.