appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
591 articles
Django admin ChangeList path traversal (CVE-2021-33203)
CVE-2021-33203 is a staff-only path traversal in Django's admindocs TemplateDetailView. Here's what's affected, its CVSS/EPSS profile, and how to remediate it.
What agentic AI security means and why traditional AppSec...
Traditional AppSec was built for static code, not decision-making agents. Here's what agentic AI security actually covers—and why autonomous agents need a new defense model.
Server-Side Request Forgery (SSRF): how it works and how to prevent it
SSRF turns a server into an attacker's proxy into your internal network. Here's how it works, what Capital One's breach taught the industry, and how to stop it.
Directory listing exposure risks explained
Directory listing vulnerabilities expose raw file trees via one misconfigured Apache, Nginx, or IIS directive. Here's how they happen and how to fix them.
Application Data Security: How to Protect Data Across Its Lifecycle
Application data security is the set of controls that protect data as your application collects, processes, stores, and transmits it. Here is a practical model for getting it right.
HTTP request smuggling explained
HTTP request smuggling exploits parser mismatches between proxies and origin servers. Learn CL.TE/TE.CL mechanics, real CVEs, and how to detect it.
SSRF via webhooks explained
Webhook SSRF turns a trusted callback feature into an internal network foothold. Here is how the attack works, real incidents, and how to actually fix it.
How to Read a Security Scanning Report Without Drowning in Noise
A security scanning report lists what a scanner found across your code, dependencies, and infrastructure. Here's how to read one, prioritize it, and act on what matters.
VAPT Tools: The Vulnerability Assessment and Penetration Testing Toolkit
VAPT tools are the software used to run vulnerability assessment and penetration testing. Here is what belongs in the toolkit, how the categories differ, and how to pick the right tool for the job.
Improper input validation (CWE-20) explained
CWE-20 explained: how improper input validation causes SQLi, RCE, and DoS, with real CVEs like Equifax's Struts breach and how to detect and fix it.
OWASP Top 10:2025 RC1: Software Supply Chain Failures Becomes Its Own Category
The OWASP Top 10:2025 release candidate, published November 2025, splits Vulnerable Components into a broader Software Supply Chain Failures category and elevates Security Misconfiguration to #2.
SAST Tooling: How to Choose and Run Static Analysis That Developers Trust
SAST tooling scans your source code for security flaws before it runs, but the tool you pick matters less than how you tune it. Here is how to choose, integrate, and keep the noise down.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.