appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
596 articles
Snyk Secret Scanning: How It Detects Hardcoded Secrets
Snyk secret scanning finds hardcoded credentials in your code as part of Snyk Code's SAST engine and, more recently, through the dedicated Snyk Secrets product. Here is what each covers and where the gaps are.
What Is Literal SQL Statement Injection, and How Do You Stop It?
Literal SQL statement injection happens when user input is concatenated straight into a query string. Here is how the attack works and how to shut it down.
Inversion of Control in JavaScript: The Security Angle Nobody Explains
Inversion of control in JavaScript decouples your code from its dependencies, but handing over instantiation also hands over a piece of your attack surface. Here is how to get the design benefit without the security cost.
What Is a DAST Solution? Choosing Dynamic Testing for Web Apps
A DAST solution tests your running application from the outside, the way an attacker would. Here is how dynamic testing works, what it catches, and how to pick one that fits your pipeline.
Understanding DOM XSS Payloads: How They Work and How to Stop Them
DOM XSS payloads execute entirely in the browser when untrusted input reaches a dangerous sink like innerHTML or eval. Here is how the class works and how to shut it down without shipping exploit code.
What Is Checkmarx? A Plain-English Overview
Checkmarx is one of the oldest names in static analysis, built for large enterprises with dedicated security teams. Here's what it actually does and how it stacks up.
Open Redirect Vulnerabilities: How Attackers Abuse Them
An open redirect attack abuses a trusted domain's own redirect functionality to send victims to a malicious site — low severity on its own, but a key ingredient in phishing and OAuth token theft.
XSS Tutorial: How Cross-Site Scripting Works and How to Stop It
A defender's XSS tutorial covering the three attack types, why they still slip through, and the encoding and CSP controls that actually prevent them.
JavaScript Exploits Explained: How They Work and How to Stop Them
A practitioner's tour of the JavaScript exploit classes that actually break production apps — prototype pollution, XSS, and malicious dependencies — with detection and fixes.
Semantic Reachability vs Call-Graph Reachability in 2026
Call graphs say a function is reachable. Semantic reachability asks whether the preconditions for exploitation hold. The difference matters for prioritization.
XSS Script Example: How Cross-Site Scripting Works and How to Stop It
A clear XSS script example shows how untrusted input becomes executable code in a victim's browser. Here is the anatomy of the three XSS types and the defenses that actually work.
What a Security Testing Service Does and When You Need One
A security testing service systematically probes your applications and infrastructure for weaknesses before attackers do. Here is what the different types cover and how to choose.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.