Application Security
Safeguard articles tagged "Application Security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
What should modern application security testing cover?
Modern application security testing layers threat modeling, code scans, dependency and secrets checks, and runtime tests. Here is what to cover first.
What makes a firewall strong in practice?
A strong firewall is defined by its rule set, patching, management access and logs, not its feature list. Use this review to find the weak points in yours.
What is extended detection and response (XDR), and is it standardized?
XDR is a market term for detection that spans endpoints and other sources, not a defined standard. See what it usually means and what to ask a vendor.
What is workload identity, and why replace static keys with it?
Workload identity gives software its own verifiable identity and short-lived credentials, so services stop sharing long-lived keys. Here is how it works.
What is web scraping and how do sites defend against it?
Web scraping is automated collection of site content. Sites can rate limit, require login and monitor traffic, but robots.txt is not access control.
What is WAAP, and does it replace a web application firewall?
WAAP extends a web application firewall to cover APIs, bots and abuse. See what it blocks, which API risks it cannot fix, and how to test before enforcing.
What is virtual patching and when is it enough?
Virtual patching blocks exploit traffic with a rule while you prepare the real fix. It buys time for known flaws but never replaces patching the code.
What is TLS offloading and when is it safe to use?
TLS offloading ends encryption at a proxy so back ends skip the work. It is safe only if the hop behind it is trusted, isolated or encrypted again.
What is single sign-on and what can go wrong with it?
Single sign-on lets one login reach many apps through signed assertions from an identity provider. Check audience, replay, injection and session ending.
What is serverless computing and what changes for security?
Serverless runs your code on demand without you managing servers. The provider secures the host, but your code, permissions and inputs still need care.
What is server virtualization and how do you secure it?
Server virtualization runs many virtual machines on one host through a hypervisor. Secure the hypervisor, management plane, guests and snapshots first.
What is runtime application self-protection (RASP) and when does it fit?
RASP runs inside an application and blocks attacks using runtime context. See how it differs from a firewall and IAST, its modes and what to test first.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.