appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
596 articles
OWASP API Security Top 10 risks explained
The OWASP API Security Top 10 ranks BOLA, broken auth, SSRF, and 7 more API risks behind breaches like Optus and T-Mobile — explained with real incidents.
OWASP Top 10 and XSS: Where Cross-Site Scripting Fits Now
In the OWASP Top 10, XSS is no longer its own category. As of the 2021 list it lives inside A03: Injection. Here is what changed, why, and how to defend against it.
VAPT Services: What They Are and How to Choose One
VAPT services combine vulnerability assessment with penetration testing to both find weaknesses and prove which ones are actually exploitable. Here is what to expect and what to ask for.
react-quill and Quill: XSS History and Safe Rich-Text Editing
Using Quill in React means understanding CVE-2021-3163, the react-quill maintenance gap, and why editor output must always be sanitized server-side before display.
Dynamic Application Security Testing Tools, Compared
Dynamic application security testing tools test running applications the way an attacker would, but they differ sharply on API coverage, auth handling, and CI integration — here's how to tell them apart.
What is DAST? Dynamic Application Security Testing explained
DAST tests running applications like an attacker would. Learn how it works, how it differs from SAST, and where it falls short.
How Snyk's --project-tags and business-criticality flags ...
How Snyk CLI's --project-tags and --project-business-criticality flags attach business context to scans, and why that context can drift out of date.
DOM-Based XSS: Finding and Fixing Client-Side Injection
DOM XSS never touches your server, so response scanners miss it. Here is how to trace sources to sinks in client code and shut the flaw down.
OWASP Top 10 Certification: What It Actually Means
There is no official OWASP Top 10 certification, but here is how to prove OWASP Top 10 competence, which credentials cover it, and how teams demonstrate coverage.
API Security Posture Management, Explained
API security posture management inventories every API you actually have, then continuously checks it against the rules you meant to enforce.
What Is Shift Left Security
Shift left security moves scanning earlier in the SDLC. Here's what it means, how Sonatype approaches it, where it falls short, and how Safeguard closes the gap.
The Confidence Gap: Why Developers Trust AI Code More Tha...
Studies show developers trust AI-generated code more than human code, even though it's often less secure. Here's what's driving the AI code trust gap.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.