appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
596 articles
Webhooks Security: A Practical Checklist
Webhooks security is easy to get wrong because the endpoint has to trust an unauthenticated inbound request by default — here's the checklist that closes the common gaps.
What Makes a Strong Application Security Solution
An application security solution is not a single scanner but a coordinated set of controls across the software lifecycle. Here is what a real one covers.
XStream Deserialization Vulnerabilities: What You Need to Know
XStream, the popular Java XML serialization library, has a long history of deserialization vulnerabilities that lead to remote code execution when it processes untrusted input — here's what changed and how to fix it.
SQL Injection Test: How to Safely Check Your App for SQLi
A SQL injection test proves whether user input can reach your database as code. Here is how to test your own applications responsibly, read the results, and fix what you find.
Best DAST Tools in 2026: Web, API, and CI/CD Scanning Compared
An honest guide to the best DAST tools in 2026 — from OWASP ZAP and Burp Suite to Invicti, StackHawk, and Escape — with clear guidance on which fits web apps, APIs, and CI/CD-native pipelines, and where DAST stops and supply chain security begins.
Mobile Application Security Assessment: How It's Actually Done
What a mobile application security assessment actually involves, from static binary analysis through dynamic testing on real devices, and where it differs from a web app pen test.
DAST Scanners: How to Choose One for Your Stack
A DAST scanner tests a running app the way an attacker would — but the options range from free crawlers to full authenticated-flow platforms. Here's how to pick.
Best SAST Tools in 2026: Semgrep, CodeQL, Snyk, and the AI Shift Compared
An honest buyer's guide to the best SAST tools in 2026 — from Semgrep and CodeQL to SonarQube, Snyk Code, and Checkmarx — plus how reachability analysis and agentic AI are reshaping static application security testing and where Safeguard fits.
Website Scanner: How It Works and What to Use
A website scanner probes a live site for security flaws like injection, misconfiguration, and known CVEs. Here is how the different scanner types work and when each one fits.
A Threat Modeling Example, Walked Through Step by Step
A concrete threat modeling example beats any amount of theory. We model a real feature, a file-upload API, with STRIDE and turn the findings into fixes.
OWASP Top 10 vulnerabilities explained
A breakdown of all 10 OWASP Top 10 categories with real CVEs (Log4Shell, Equifax, Heartbleed) mapped to each, and stats on which risks hit production most.
Code Vulnerability Scanning Tools: How to Choose the Right One
Code vulnerability scanning tools fall into distinct categories that see different risks. Knowing which does what is the difference between coverage and false confidence.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.