Application Security
Safeguard articles tagged "Application Security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
What is risk based vulnerability management in application security?
Risk based vulnerability management ranks findings by exploitation evidence, reachability and exposure, not severity alone. Here is how to run it on code.
What is responsible disclosure and how does it work?
Responsible disclosure means reporting a flaw privately so the owner can fix it before details go public. Learn the process, timelines and setup steps.
What is passwordless authentication and is it actually safer?
Passwordless sign-in replaces shared secrets with public key credentials such as passkeys. Learn why it resists phishing and where it can still fail.
What is MAST (mobile application security testing) and how is it done?
MAST tests mobile apps for security flaws using static, dynamic and network analysis, measured against OWASP MASVS. Learn the steps and what each finds.
What is machine identity and why are certificate lifetimes shrinking?
Machine identity is how software, servers and services prove who they are. See the main kinds, the public TLS certificate lifetime schedule and what to do.
What is federated identity and how does it work?
Federated identity lets one trusted provider vouch for a user to many separate services. Learn how SAML and OpenID Connect do it, and the risks.
What is external attack surface management and how do you do it?
EASM is the routine of finding every internet facing asset you own and fixing what is exposed. A weekly discovery loop based on NIST and CISA guidance.
What is CVSS and how should you read a score?
CVSS rates how severe a vulnerability is, not how risky it is for you. How the four metric groups work in version 4.0 and how to use scores sensibly.
What is CICD-SEC-6, insufficient credential hygiene, in pipelines?
CICD-SEC-6 covers secrets leaked in code, logs and image layers, plus broad credentials that never rotate. Here are the five failure modes and fixes.
What is certificate pinning and should you use it?
Certificate pinning ties an app to expected certificates or keys. It blocks rogue CAs but causes outages, so most teams should skip it or plan carefully.
What is cert-manager and how does it handle Kubernetes TLS?
cert-manager issues and renews TLS certificates inside Kubernetes. Learn how issuers work, where private keys end up, and how to audit your setup today.
What is BOLA (OWASP API1) and how do you fix it?
BOLA lets a user read or change another user's data by swapping an object ID in a request. Fix it with an ownership check on every object, plus tests.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.