AppSec
In-depth guides and analysis on appsec from the Safeguard engineering team.
309 articles
Blind SQL Injection: A Practical Cheat Sheet
This blind sql injection cheat sheet covers how boolean-based and time-based blind attacks actually work, why they succeed against apps with no visible error output, and how to close them off.
Application Layer Security: What It Covers (and What It Doesn't)
Application layer security protects the code, logic, and APIs at the top of the OSI stack, but it's easy to confuse it with network or infrastructure security controls that solve a different problem.
Application Vulnerability Testing Methods, Compared
Application vulnerability testing spans static analysis, dynamic testing, dependency scanning, and manual review — each catches a different slice of application security vulnerabilities, and none covers all of them alone.
How SQL Injection Works and How to Prevent It
How to perform SQL injection is really a question about how the attack class works so you can detect and stop it. A defensive walkthrough of the mechanism and the fixes that hold.
How to Run a ZAP Scan: OWASP ZAP for Practical Web App Testing
A hands-on guide to running a ZAP scan against your own web app, from the passive baseline to a full active scan, and how to wire it into CI.
DAST vs Penetration Testing: Which One Does Your App Actually Need?
DAST vs penetration testing comes down to automation versus human creativity. Here is how they differ, where SAST fits, and why mature teams run all three.
Snyk Dependency Scanning: How It Works, Its Limits, and Alternatives
A fair look at Snyk dependency scanning: what it does well, how its test-based pricing works, where teams hit limits, and how to decide if it fits your workflow.
Spring Framework RCE Vulnerabilities: A History
From Spring4Shell to older data binding flaws, Spring framework RCE bugs keep resurfacing in the same handful of places — data binding, expression evaluation, and class loading.
Code Scanning Tools: SAST, Secrets, and Linters Compared
SAST tools, secret scanners, and linters all read your source code but catch entirely different classes of problems — here's how to tell them apart and stack them correctly.
Application Vulnerability Assessment: Scope, Method, and Reporting
Most assessment reports die unread because scope was fuzzy and findings were not verified. A working method for assessments that end in shipped fixes.
API Security Scanning: What Good Tools Actually Catch
API security scanning explained in terms of the specific failure classes it catches, from broken object-level authorization to shadow endpoints, and why generic web scanners miss most of them.
Application Security Testing Tools: SAST, DAST, IAST, and SCA Compared
Four scanner families see four different slices of your risk. What SAST, DAST, IAST, and SCA each catch and miss, and how to sequence them in CI without drowning developers.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.