appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
596 articles
What Is Black Box Testing? A Security Guide with Examples
Black box testing probes a system from the outside with no view of its internals. Here is what it catches, where it falls short, and how it fits a security program.
Checkmarx Tutorial: A Practical Guide to Getting Started
A hands-on Checkmarx tutorial covering what the platform scans, how to run your first SAST scan, triaging results, and wiring the CLI into CI.
Claude Opus 4.8 for Security Teams: Capabilities, AppSec Use, and Governance (May 2026)
Anthropic shipped Claude Opus 4.8 on May 28, 2026, with sharper agentic coding and better honesty about its own work. Here is what it changes for vulnerability triage, fix-PRs, and the governance you need before it touches your pipeline.
Static vs Dynamic Code Analysis: The Real Tradeoffs
Static analysis reads code without running it; dynamic analysis watches an application behave — the real question isn't which is better, it's which gap each one leaves open.
What Is a False Positive in Cyber Security?
A false positive in cyber security is a benign event flagged as malicious. Here's how false positives and false negatives differ, why they matter, and how to tune the balance.
How to Run a Website Security Check (Free and Paid Methods)
A step-by-step website security check using free tools and paid platforms, from a quick URL scanner pass to authenticated scans and dependency analysis.
From Inventory to Insight: Turning SBOM Data Into Priorit...
A complete SBOM often surfaces thousands of CVEs. Here's how reachability, exploitability, and business context turn that noise into a prioritized action plan.
Why Alert Fatigue, Not Tool Gaps, Is the Real AppSec Bott...
AppSec teams don't fail from missing tools, they fail from thousands of unprioritized alerts. Here's why alert fatigue is the real AppSec bottleneck.
Runtime Reachability Analysis: Cutting Through Vulnerabil...
Most CVE findings are noise. Here's how runtime reachability analysis separates exploitable risk from theoretical severity, and why CVSS alone can't prioritize your patch queue.
How Risk Scoring Models Differ Across AppSec Platforms
CVSS, EPSS, SSVC, and vendor priority scores all measure vulnerability risk differently. Here's how they diverge, with real numbers, and how reachability analysis cuts through the noise.
jwks-rsa: Verifying JWTs Against a JWKS Endpoint Safely
The jwks-rsa npm library fetches signing keys from a JWKS endpoint so you can verify JWTs correctly. Here is how to wire it up without introducing key-confusion or availability bugs.
Checkmarx SAST: How It Works, What It Scans, and Where It Fits
Checkmarx SAST is a static application security testing engine that finds flaws in your source code without running it. Here is how it works, what it scans, and how to fit it into a pipeline.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.