AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
xercesImpl: XXE Risks in Java XML Parsing and How to Configure It
The xercesImpl Maven artifact turns up transitively in thousands of Java builds. Here is its real CVE history, why XXE is your configuration's fault, and the hardening block to paste.
SAST Meaning and Full Form: Static Application Security Testing Explained
SAST stands for Static Application Security Testing — analyzing source code for vulnerabilities without running it. Here is what the term means, how it works, and where it fits alongside DAST and SCA.
Software Security Testing: A Practitioner's Overview
Software security testing spans static analysis, dynamic testing, dependency scanning, and manual review — a practical map of which method catches what, written for people who actually run these programs.
SAST Full Form and What It Actually Tests
SAST stands for static application security testing — analyzing source code without running it. Here's exactly what it catches, what it misses, and how it fits a pipeline.
Securing Spring Security OAuth2 and JOSE Dependencies
spring-security-oauth2-jose sits at the center of many Java auth stacks, but the legacy project is deprecated and its JOSE/JWT dependencies carry their own patch history; here is how to assess and reduce the risk.
Security Testing for Data Pipelines: A Practical Guide
Data pipelines ingest, transform, and move sensitive information across systems. Here is how to identify and address the security risks that traditional application testing misses.
Application Security Consulting: What to Actually Expect
Application security consulting services range from a two-week penetration test to a multi-year embedded program, and knowing which one you're buying changes what you should expect to get out of it.
Application Security Testing Services: A Buyer's Guide
A practical framework for evaluating application security testing services in 2026, from what should be included by default to the questions that separate a real program from a checkbox audit.
Web Application Security Testing Tools in 2026
A category map of web application security testing tools in 2026, from SAST and DAST to API scanners, and how to pick a stack that matches your architecture.
Application Security Software: A Category-by-Category Guide
A map of the application security software market by category — SAST, DAST, SCA, ASPM, and more — so buyers can tell which tool solves which problem.
Runtime Application Security Protection (RASP), Explained
Runtime application security protection instruments your app from the inside so it can block attacks in production, not just flag them in a report.
What Is AppSec, and Who Owns It on a Modern Team?
AppSec covers every security decision made about how software is designed, built, and shipped — but ownership is more distributed than most org charts admit.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.