AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
Unrestricted File Upload Vulnerabilities: Risks and Fixes
An unrestricted file upload vulnerability lets an attacker place a working web shell on your server through a form that was only ever supposed to accept profile pictures or PDFs.
IAST Security: Interactive Application Security Testing Explained
IAST security instruments a running application to watch real requests flow through real code, catching vulnerabilities that static analysis and black-box scanning both miss.
SCA in DevSecOps: Automating Dependency Security in CI/CD
SCA in DevSecOps means wiring software composition analysis into your pipeline so vulnerable dependencies get caught on every commit instead of at audit time.
DAST Solutions: How to Choose the Right Dynamic Testing Tool
DAST solutions test a running application from the outside to find exploitable flaws. Here is how they work, what they catch, and how to evaluate one for your pipeline.
SQL Injection Example: How It Works and How to Stop It
A clear SQL injection example makes the vulnerability obvious. Here are illustrative cases, the main attack types, and the fixes that actually eliminate the risk.
Security Testing Automation: What to Automate, and What Not To
Security testing automation pays off fastest on repetitive, well-defined checks — here's a clear line between what to automate and what still needs a human.
What Is VAPT? A Practical Guide to Vulnerability Assessment and Penetration Testing
VAPT combines automated vulnerability assessment with hands-on penetration testing. Here is what each half actually does and how to run VAPT that finds real risk.
SQL Injection Examples: Real Attack Patterns and How to Stop Them
SQL injection examples that show the attack patterns behind the CWE, why they work, and the parameterized-query fix that stops all of them at once.
The xss npm Package: Sanitizing HTML Input Correctly
The xss npm package is a whitelist-based HTML sanitizer for Node and the browser. It works well — when you sanitize in the right place, with the right whitelist, for the right output context.
CVE-2023-4863: The libwebp Zero-Day That Hit Chrome and More
CVE-2023-4863 was a heap buffer overflow in libwebp's Huffman decoding that was exploited as a zero-day in the wild — and because libwebp sits inside Chrome, Firefox, and countless Electron apps, one library bug became an ecosystem-wide emergency patch.
Vuln Scan Basics: How Vulnerability Scanning Actually Works
What a vuln scan is, the main scanner types, how to read a report without drowning in noise, and how to fit scanning into a development pipeline.
Define SCA: What Software Composition Analysis Actually Means
To define SCA: it's the practice of identifying every open-source component in your software and checking each for known vulnerabilities, license risk, and staleness.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.