AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
SAST, DAST, and SCA: The Three Scanner Types You Actually Need
Each scanner type answers a different question about your application. Here's what SAST, DAST, and SCA each catch, and why running just one leaves gaps.
Web Application Vulnerability Scanners, Compared
Web application vulnerability scanners range from free online URL checkers to full DAST platforms — here's how the categories differ and which one actually matches your risk.
Code Scan Tools: How They Work and What to Use
A practical breakdown of code scan tool categories — SAST, SCA, secrets, and DAST — how each works, and how to choose and combine them without alert fatigue.
API Scanner Tools: What to Look For
An API scanner tool needs to do more than replay a Postman collection against your endpoints. Here's what actually separates a useful API scanner from one that generates noise.
Source Code Analysis Tools: SAST, Linters, and Semantic Engines
Not all source code analysis tools do the same job. Linters, pattern-based SAST, and semantic dataflow engines catch different bug classes, and mixing them up wastes budget.
Encryption and Decryption in Python: A Practical Guide
Encryption in Python is easy to get working and surprisingly easy to get wrong — here's how to do symmetric and asymmetric encryption correctly using the cryptography library instead of rolling your own.
How an API Security Scanner Works and What to Use
An API security scanner automatically probes your endpoints for authentication, authorization, and injection flaws. Here is how they work and how to fit one into your pipeline.
SQL Injection Strategies: A Free Guide (No PDF Download Needed)
Looking for a SQL injection strategies PDF free download? Here is the defensive material that actually matters, covering how the attack works and how to shut it down.
App Vulnerability Scanner: How It Works and What to Use
An app vulnerability scanner automatically probes your application for known flaws and misconfigurations. Here is how the main types work and how to pick the right one.
Nginx Version Vulnerabilities: CVE Guide from 1.10 to 1.24
From the nginx 1.18.0 vulnerability set back to 1.10.3 and forward to 1.24.0: which CVEs actually apply to each version line, which need specific config to exploit, and where to upgrade.
SSRF Meaning: What Server-Side Request Forgery Is and How to Stop It
SSRF stands for Server-Side Request Forgery, a vulnerability where an attacker tricks your server into making requests on their behalf. Here is what it means, why it is dangerous, and how to defend against it.
Checkmarx DAST: What It Does and How It Fits an AppSec Program
Checkmarx DAST is the dynamic testing component of the Checkmarx One platform, scanning running web apps and APIs for vulnerabilities. Here is how it works and where it fits.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.