appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
596 articles
cookie-parser in Express: Security Guide and Best Practices
The cookie-parser npm middleware is deceptively simple, but signed-cookie misuse and a 2024 CVE in its underlying cookie library still catch Express teams out.
How to Scan a Web App for Vulnerabilities (Without Fooling Yourself)
To scan web applications well you need the right tool for the right layer. Here is what a web scan actually catches, where each type falls short, and how to combine them.
MySQL Injection Cheat Sheet: How to Detect and Stop SQLi
A defender's MySQL injection cheat sheet: the query patterns attackers probe for, how login bypass and UNION-based extraction work, and how to shut them down.
How to Run a Secret Scan Across Your Codebase
A secret scan finds hardcoded credentials, API keys, and tokens in your code and history before an attacker does. Here is how to scan, what to catch, and how to respond.
Artificial Intelligence Security Tools: What They Do and How to Choose
Artificial intelligence security tools now sit in two camps: tools that use AI to defend software, and tools that defend the AI itself. Knowing which one you need shapes the whole buying decision.
DevSecOps SAST: How to Wire Static Analysis Into Your Pipeline
SAST in DevSecOps means catching code-level flaws before they merge, not after they ship. Here is how to integrate static analysis so developers actually use it.
The Java Cheat Sheet Developers Actually Need for Secure Code
Most Java cheat sheets stop at syntax. This one is the security-focused reference: the APIs, patterns, and one-liners that keep injection, deserialization, and crypto bugs out of your code.
Web Session Security: A Practical Guide
Web session security is the set of controls that keep a logged-in user's session token from being stolen, guessed, or reused by an attacker — and most of it comes down to a handful of cookie flags and lifecycle rules teams routinely skip.
AppSec Program Management: Building One That Sticks
AppSec program management is the discipline of turning scattered security tools into a governed, measurable program with owners, policies, and metrics. Here is how to build one.
Vulnerability Assessment Services: What's Actually Included
Vulnerability assessment services bundle scanning, triage, and remediation tracking — but the scope varies widely between vendors, and knowing what's actually included changes what you should pay.
VAPT Meaning: What Vulnerability Assessment and Penetration Testing Actually Covers
VAPT stands for Vulnerability Assessment and Penetration Testing — two different security exercises that get bundled into one acronym. Here is what each half does and when you need which.
Cyber insurance requirements for application security programs
Cyber insurers now require SBOMs, patch SLAs, and audit trails for AppSec programs. Here's what carriers actually ask for and how to pass renewal.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.