Safeguard
Tag

appsec

Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.

596 articles

Application Security

A Scanner's Scope Guard Belongs in Code, Not in a Config File

The difference between a security test and an unauthorised attack is permission on the target. If that boundary is a setting, then a typo, a redirect or a merged config is all it takes to cross it.

Aug 16, 20264 min read
Application Security

Authenticated DAST: Getting Past the Login Without Wrecking the App

Most of an application is behind a session, so an unauthenticated scan tests the login page and the marketing footer. Getting in is the easy half — staying in, and not clicking Delete Account, is the rest.

Aug 16, 20265 min read
AppSec

What Tree-sitter Taint Analysis Actually Catches (and What It Cannot)

Following untrusted data from source to sink across a real codebase is a solved problem right up until reflection, dynamic dispatch and an ORM turn up. Knowing where the analysis stops is what makes it usable.

Aug 15, 20265 min read
AppSec

Recall Is Easy. Your SAST Tool's Real Metric Is the Mute Rate

Any scanner can find every vulnerability by flagging everything. The number that decides whether a tool survives contact with a development team is how often it is wrong.

Aug 15, 20265 min read
Vulnerability Analysis

"Not Demonstrated" Is Not "Not Vulnerable"

Exploitability is not a boolean. Collapsing it into one loses the only state that tells a developer what to do next — and quietly converts every unanswered question into a dismissal.

Aug 14, 20265 min read
Vulnerability Analysis

Django admin ChangeList path traversal (CVE-2021-33203)

CVE-2021-33203 is a staff-only path traversal in Django's admindocs TemplateDetailView. Here's what's affected, its CVSS/EPSS profile, and how to remediate it.

Aug 8, 20267 min read
AI Security

What agentic AI security means and why traditional AppSec...

Traditional AppSec was built for static code, not decision-making agents. Here's what agentic AI security actually covers—and why autonomous agents need a new defense model.

Aug 5, 20268 min read
Vulnerability Analysis

Server-Side Request Forgery (SSRF): how it works and how to prevent it

SSRF turns a server into an attacker's proxy into your internal network. Here's how it works, what Capital One's breach taught the industry, and how to stop it.

Aug 3, 20266 min read
Vulnerability Analysis

Directory listing exposure risks explained

Directory listing vulnerabilities expose raw file trees via one misconfigured Apache, Nginx, or IIS directive. Here's how they happen and how to fix them.

Aug 3, 20267 min read
Security

Application Data Security: How to Protect Data Across Its Lifecycle

Application data security is the set of controls that protect data as your application collects, processes, stores, and transmits it. Here is a practical model for getting it right.

Jul 31, 20267 min read
Vulnerability Analysis

HTTP request smuggling explained

HTTP request smuggling exploits parser mismatches between proxies and origin servers. Learn CL.TE/TE.CL mechanics, real CVEs, and how to detect it.

Jul 30, 20267 min read
Vulnerability Analysis

SSRF via webhooks explained

Webhook SSRF turns a trusted callback feature into an internal network foothold. Here is how the attack works, real incidents, and how to actually fix it.

Jul 29, 20267 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

appsec — Safeguard Blog