AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
306 articles
What Is VAPT? A Practical Guide to Vulnerability Assessment and Penetration Testing
VAPT combines automated vulnerability assessment with hands-on penetration testing. Here is what each half actually does and how to run VAPT that finds real risk.
The xss npm Package: Sanitizing HTML Input Correctly
The xss npm package is a whitelist-based HTML sanitizer for Node and the browser. It works well — when you sanitize in the right place, with the right whitelist, for the right output context.
CVE-2023-4863: The libwebp Zero-Day That Hit Chrome and More
CVE-2023-4863 was a heap buffer overflow in libwebp's Huffman decoding that was exploited as a zero-day in the wild — and because libwebp sits inside Chrome, Firefox, and countless Electron apps, one library bug became an ecosystem-wide emergency patch.
Vuln Scan Basics: How Vulnerability Scanning Actually Works
What a vuln scan is, the main scanner types, how to read a report without drowning in noise, and how to fit scanning into a development pipeline.
Define SCA: What Software Composition Analysis Actually Means
To define SCA: it's the practice of identifying every open-source component in your software and checking each for known vulnerabilities, license risk, and staleness.
xercesImpl: XXE Risks in Java XML Parsing and How to Configure It
The xercesImpl Maven artifact turns up transitively in thousands of Java builds. Here is its real CVE history, why XXE is your configuration's fault, and the hardening block to paste.
SAST Meaning and Full Form: Static Application Security Testing Explained
SAST stands for Static Application Security Testing — analyzing source code for vulnerabilities without running it. Here is what the term means, how it works, and where it fits alongside DAST and SCA.
Software Security Testing: A Practitioner's Overview
Software security testing spans static analysis, dynamic testing, dependency scanning, and manual review — a practical map of which method catches what, written for people who actually run these programs.
SAST Full Form and What It Actually Tests
SAST stands for static application security testing — analyzing source code without running it. Here's exactly what it catches, what it misses, and how it fits a pipeline.
Security Testing for Data Pipelines: A Practical Guide
Data pipelines ingest, transform, and move sensitive information across systems. Here is how to identify and address the security risks that traditional application testing misses.
What Is AppSec, and Who Owns It on a Modern Team?
AppSec covers every security decision made about how software is designed, built, and shipped — but ownership is more distributed than most org charts admit.
What Does SAST Stand For, Exactly?
SAST stands for static application security testing — analyzing source code for vulnerabilities without ever running the program, which is what separates it from every dynamic testing approach.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.