appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
596 articles
Blind and Out-of-Band XXE: How XXE Injection Really Works
A defensive guide to XXE injection, including the blind and out-of-band variants that leak data with no visible response, plus how to detect and shut them down.
The OWASP Top 10 API Security Risks, Explained
The OWASP Top 10 API Security Risks reorder the classic web vulnerability list around how APIs actually get broken — object-level authorization failures beat injection as the most common real-world root cause.
How Snyk Code's detection differs across Java, JavaScript...
Snyk Code applies one hybrid AI-plus-symbolic engine to ten languages, but rule depth, autofix coverage, and taint tracking vary widely by language.
How Snyk Code's confidence scoring separates high-confide...
How Snyk Code's confidence scoring works under the hood, and why "high confidence" and "severity" are not the same axis for triage.
Web App Pen Testing: A Practical Guide for Developers
Web app pen testing simulates a real attacker to find exploitable flaws before they do. Here is how the process works, what it covers, and where it fits alongside automated scanning.
Static analysis (SAST) tool buyer's guide
A concrete, checkable buyer's guide comparing Safeguard and Black Duck on SAST analysis architecture, taint-tracking depth, reachability-driven triage, and unified findings data models.
Enterprise AppSec risk management at scale
Black Duck built its platform on decades of license-compliance SCA and acquired tools. Safeguard built a unified, reachability-aware supply-chain risk platform from day one.
API Security: A Clear Definition and What It Covers
The API security definition is straightforward: protecting the APIs that expose your data and logic from misuse, abuse, and unauthorized access. What that covers in practice is broader than most teams assume.
Application Security vs Network Security: Where the Line Is
Application security vs network security comes down to what layer you're defending — code and logic versus traffic and perimeter — and most breaches now happen in the gap between them.
A Checkmarx Scan: What It Actually Analyzes
A breakdown of what a Checkmarx scan actually analyzes under the hood, what its static analysis engine catches well, and where teams typically add another tool alongside it.
Introducing Agentic Development Security (ADS)
As AI agents now author up to half of production commits, Safeguard introduces Agentic Development Security (ADS) — a new framework for securing autonomous coding.
How to Run an API Security Scan (and What It Catches)
An API security scan probes your endpoints for auth flaws, broken object-level access, injection, and misconfiguration. Here is how to scan an API properly.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.