AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
The OWASP Top Ten Vulnerabilities, Explained
The OWASP Top Ten vulnerabilities is the industry-standard list of the most critical web application security risks. Here is what the current 2025 edition covers and how to defend against each.
What Is Black Box Testing? A Security Guide with Examples
Black box testing probes a system from the outside with no view of its internals. Here is what it catches, where it falls short, and how it fits a security program.
Snyk DAST: What Snyk API & Web Offers for Dynamic Testing
A factual look at Snyk DAST — how Snyk API & Web fits dynamic application security testing into a developer-first platform, what it covers, and how to weigh it against alternatives.
OWASP ZAP as a DAST Tool: Getting Started
OWASP ZAP DAST scanning is free, mature, and a genuinely solid starting point — here's how to run your first zap scan and what to expect once you scale past it.
Static vs Dynamic Code Analysis: The Real Tradeoffs
Static analysis reads code without running it; dynamic analysis watches an application behave — the real question isn't which is better, it's which gap each one leaves open.
How to Run a Website Security Check (Free and Paid Methods)
A step-by-step website security check using free tools and paid platforms, from a quick URL scanner pass to authenticated scans and dependency analysis.
jwks-rsa: Verifying JWTs Against a JWKS Endpoint Safely
The jwks-rsa npm library fetches signing keys from a JWKS endpoint so you can verify JWTs correctly. Here is how to wire it up without introducing key-confusion or availability bugs.
OWASP 2019: The API Security Top 10 That Reshaped API Testing
The OWASP release everyone means by 2019 is the first API Security Top 10, which put authorization flaws — not injection — at the center of API risk.
Checkmarx SAST: How It Works, What It Scans, and Where It Fits
Checkmarx SAST is a static application security testing engine that finds flaws in your source code without running it. Here is how it works, what it scans, and how to fit it into a pipeline.
JavaScript Security Scanner: How It Works and What to Use
A JavaScript security scanner analyzes your code and dependencies for vulnerabilities. Here's what the different scanner types catch and how to wire them into CI.
Automated Vulnerability Scanning Tools: How They Work and What to Look For
Automated vulnerability scanning tools turn a once-a-year audit into a continuous safety net — if you understand what each type actually inspects.
JavaScript Vulnerability Scanner: How It Works and What to Use
A JavaScript vulnerability scanner finds risky dependencies and insecure code across your Node and browser projects. Here is how the different types work.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.