AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
Choosing an npm XML Parser: Security Comparison and XXE Pitfalls
Not every npm XML parser carries the same risk. We compare xml2js, fast-xml-parser, sax, and libxmljs on their CVE history, XXE exposure, and safe configuration.
ASPM Security: Application Security Posture Management Explained
ASPM doesn't scan anything new — it aggregates and prioritizes findings your existing SAST, DAST, and SCA tools already produce, which is exactly the problem most AppSec teams actually have.
Bootstrapping a Secure Website Scan Workflow on a Budget
A small team can build a real scanning habit with zero budget — the trick is turning one-off checks into a repeatable workflow before traffic (and risk) grows.
DAST Meaning: What Dynamic Application Security Testing Actually Is
DAST stands for Dynamic Application Security Testing, a way of finding vulnerabilities by attacking a running application from the outside. Here is what that means in practice.
Code Quality Scanning: What It Catches and Why Security Cares
Code quality scanning and security scanning overlap more than most teams realize. Here is what static analysis of code quality actually finds and how to run it without alert fatigue.
Website Security Scan: What It Checks and How to Run One
A website security scan tests a live site for common weaknesses. Here is what the different scan types actually check, how to read the results, and where the free ones fall short.
SSRF Full Form: What Server-Side Request Forgery Means
The SSRF full form is Server-Side Request Forgery, a vulnerability where an attacker tricks your server into making requests on their behalf. Here is what that means and how to defend against it.
SQL Injection Demo: How the Attack Works and How to Stop It
A practical SQL injection demo that shows how unsanitized input reaches the database, why it works, and the one fix that reliably closes the hole.
URL Encoding and Decoding in Java: URLEncoder and URLDecoder
How URLEncoder.encode in Java actually behaves, why it turns spaces into plus signs, the Charset overload you should be using, and where hand-rolled encoding turns into an injection bug.
DOM-Based XSS Attacks: How They Work and How to Prevent Them
A DOM based XSS attack executes entirely in the browser, which is why your server-side filters and access logs never see it. Here is how the source-to-sink flow works and what actually stops it.
Application Security Automation: What to Automate First
Automation pays off in a strict order: dependencies, secrets, static analysis, then dynamic testing. Here is the sequence, why it works, and what should stay manual.
Cloud Scan: What It Is and How to Run One That Matters
A cloud scan checks your running cloud accounts, images, and code for misconfigurations and known vulnerabilities. Here is how to scope one so the results are actionable instead of overwhelming.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.