application-security
Safeguard articles tagged "application-security" — guides, analysis, and best practices for software supply chain and application security.
642 articles
Preventing broken access control in Express.js applications
Express.js ships with no built-in authorization layer, making broken access control easy to introduce and hard to catch with pattern-based scanners.
Security concerns of using the Node.js VM module as a sandbox
Node's vm module and vm2 were never a security boundary. Four critical CVEs and a 2023 deprecation prove why untrusted-code sandboxes need real isolation.
How to Run JavaScript Code: Methods and Security Notes
A practical guide to how to run JavaScript code in the browser, with Node.js, and from the command line, plus the security traps that turn a convenient runner into a liability.
What is Application Security (AppSec)
Application security spans SAST, SCA, secrets and container scanning. See how AppSec differs from DevSecOps, why it's now board-level, and how Safeguard prioritizes fixes.
Static Application Security Testing (SAST)
SAST scans source code for exploitable flaws before deployment. Learn how it works, how it differs from DAST/SCA, and where it falls short.
How Does SAST Work? Stages of SAST Scanning
A stage-by-stage breakdown of how SAST scanning actually works — parsing, taint analysis, false positives — with real CVEs and benchmark data.
Dynamic Application Security Testing (DAST)
DAST tests running apps like an attacker would. Learn how it works, what it catches and misses, and how PCI DSS 4.0 now mandates it.
What Is vm2? The Node.js Sandbox and Its Security History
vm2 was the most popular way to run untrusted JavaScript inside Node.js — until a string of sandbox-escape CVEs and its 2023 deprecation showed why sandboxing a dynamic language is so hard to get right.
Enterprise SCA Platform Buyer Guide 2026
A 2026 buyer guide for enterprise SCA platforms covering language coverage, reachability, policy depth, integration surface, and how the consolidator market is shifting.
Interactive Application Security Testing (IAST)
IAST instruments running apps to catch injection flaws and unsafe data flows in real time. Here's how it works, its limits, and where it fits.
Runtime Application Self-Protection (RASP)
RASP blocks attacks from inside a running app. Learn how it works, how it differs from a WAF, its limits, top vendors, and where it fits with SAST/SCA.
SAST vs DAST: Key Differences
SAST reads code before it runs; DAST attacks it while it's live. Here's what each catches, what each misses, and when to run both.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.