AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
306 articles
What Does SAST Mean? Static Application Security Testing, Explained
A plain-English answer to what SAST means, how static analysis finds vulnerabilities in source code, what it catches, what it misses, and where it fits alongside DAST and SCA.
URL Validation in JavaScript: Regex Patterns and Safer Options
URL validation regex in JavaScript is tempting but brittle. Here are patterns that work, the ones that cause ReDoS, and why the URL constructor is usually the better tool.
WAF SQL Injection Protection: What It Catches and What It Misses
A WAF can block many SQL injection attempts at the edge, but treating it as your only defense is how breaches happen. Here is what WAF SQL injection rules actually do.
DAST Definition: What Dynamic Application Security Testing Means
The DAST definition in one line: testing a running application from the outside by sending real requests to find exploitable vulnerabilities. Here is what that means in practice.
Website Scanners, Web Scanners, and URL Scanners: What's the Difference
Website scanner, web scanner, and URL scanner are often used interchangeably, but they can mean very different depth of analysis depending on the vendor. Here's how to tell them apart.
Free SAST Tools: The Best Open Source Scanners to Start With
The best free SAST tools include Semgrep, CodeQL, Bandit, and gosec. Here is what each one is good at and how to assemble a no-cost static analysis stack that actually catches bugs.
What Is a Package Vulnerability Scanner and How Do You Pick One?
A package vulnerability scanner checks your dependencies against known-CVE databases so you catch risky libraries before they ship. Here is how they work and what separates a good one.
Static Code Scanning Tools: How to Choose and Use Them
Static code scanning tools read your source without running it to find bugs and security flaws. Here is how they work, where they fall short, and how to pick one.
Choosing an npm XML Parser: Security Comparison and XXE Pitfalls
Not every npm XML parser carries the same risk. We compare xml2js, fast-xml-parser, sax, and libxmljs on their CVE history, XXE exposure, and safe configuration.
Bootstrapping a Secure Website Scan Workflow on a Budget
A small team can build a real scanning habit with zero budget — the trick is turning one-off checks into a repeatable workflow before traffic (and risk) grows.
DAST Meaning: What Dynamic Application Security Testing Actually Is
DAST stands for Dynamic Application Security Testing, a way of finding vulnerabilities by attacking a running application from the outside. Here is what that means in practice.
Code Quality Scanning: What It Catches and Why Security Cares
Code quality scanning and security scanning overlap more than most teams realize. Here is what static analysis of code quality actually finds and how to run it without alert fatigue.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.