Security
In-depth guides and analysis on security from the Safeguard engineering team.
521 articles
ngx-bootstrap Security: What to Know After the 2025 npm Compromise
ngx-bootstrap is a popular Angular component library that was hit by a real npm supply-chain attack in September 2025. Here is what happened, what to check, and how to use it safely.
CVE-2023-34455: snappy-java's Unchecked Chunk Length DoS
CVE-2023-34455 lets an attacker crash a JVM by feeding snappy-java a bogus chunk length. Here is the root cause, affected versions, and the fix.
Interactive Application Security Testing Tools: How IAST Works and When to Use It
IAST watches your running application from the inside during normal testing, catching real, reachable flaws that static scanners can only guess at.
CVE-2023-42794: The Apache Tomcat Incomplete Cleanup DoS Explained
An unreleased refactoring in Tomcat's bundled Commons FileUpload left temp files undeleted on Windows, risking a disk-exhaustion DoS. Here is what CVE-2023-42794 is and how to fix it.
CWE Meaning: What Common Weakness Enumeration Is and Why It Matters
The CWE meaning is simpler than it looks: a shared catalog of software weakness types. Here is how it differs from CVE and how to actually use it.
What Does 'CVE: BYN' Mean? Decoding Vulnerability Identifiers
If you searched for 'cve: byn', you probably landed on a garbled query. Here is what a CVE identifier actually is, how to read one, and why 'BYN' is not part of it.
How Do You Run a Vulnerability Test? A Practical Guide
A vulnerability test is a systematic check of a system for known security weaknesses. Here is what it involves, the types available, and how to run one that produces action instead of a wall of findings.
Checkmarx API Security: What It Does and How to Use It
Checkmarx API Security discovers your real API footprint — including shadow and zombie endpoints — and correlates static and dynamic findings. Here's how it fits an AppSec program.
CVE-2023-46589: The Tomcat Request Smuggling Flaw, Explained
CVE-2023-46589 lets an attacker smuggle HTTP requests past a reverse proxy by abusing malformed trailer headers in Apache Tomcat. Here is how it works and which versions to run.
PHP Code Checker Tools: How to Catch Bugs and Security Flaws in PHP
A PHP code checker can mean a syntax linter, a static analyzer like PHPStan, or a security taint scanner. Here is what each one catches and how to combine them.
Working With the Semgrep API: Pulling Findings and Automating Scans
The Semgrep API lets you list deployments, pull findings, and manage projects and tokens programmatically. Here is how authentication works and how to use it well.
App Security Tools: A Practical Guide to Building Your AppSec Stack
The right app security tools do not overlap by accident — each one covers a layer the others cannot see, and the gaps between them are where breaches start.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.