appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
591 articles
JavaScript Vulnerability Scanners: How They Actually Work
A javascript vulnerability scanner has to reason about a dynamically typed, dependency-heavy language — which is why the good ones combine static analysis with dependency-graph lookups rather than relying on either alone.
The Main Types of Security Vulnerabilities, Explained
A practical tour of the main types of security vulnerabilities developers meet, from injection and broken access control to vulnerable dependencies, with defenses for each.
Product Security vs Application Security: What's the Difference
Application security protects the code and runtime of a single piece of software; product security is the broader discipline covering that software's entire lifecycle, including hardware, supply chain, and how customers actually use it.
Free Web Security Scanners: What to Expect From the Free Tier
What a free web security scanner will and won't catch, how the free tiers of popular tools are actually limited, and when you need to pay for real coverage.
simple-git: Command Injection CVEs and Safe Usage Patterns
The npm simple-git library went through a chain of argument injection CVEs in 2022, each an incomplete fix of the last. The history is a case study in why wrapping a CLI safely is hard.
A Threat Model Example, Walked Through Step by Step
The fastest way to understand threat modeling is to watch one built end to end — this walks through a real threat model example for a simple login and payment flow.
Web Scanners: How They Work and What to Use
A web scanner probes a running application for vulnerabilities the way an attacker would. Here is how the different types work and how to pick one that finds real bugs.
Website Security Scanners: How a Site Scanner Works and What to Use
A site scanner crawls a live website and probes it for security issues, from missing headers to injection flaws. Here is how the scan works and how to pick one.
Site Security Scan: How to Check a Website for Vulnerabilities
A site security scan probes a live website for exploitable weaknesses, from injection flaws to misconfigured headers. Here is what a real scan covers and how to run one that finds something useful.
What the Checkmarx Tool Is Used For: A Practical Guide
The Checkmarx tool is a static application security testing platform that scans source code for vulnerabilities before you ship. Here is what it does, where it fits, and its limits.
XXE Example in Java: How the Attack Works and How to Stop It
A concrete XXE example in Java showing why default XML parsers are dangerous, what an attacker can read, and the exact parser configuration that shuts it down.
Gartner and SAST: How the AST Magic Quadrant Covers Static Analysis
There is no standalone Gartner SAST Magic Quadrant. Here is how Gartner actually evaluates static analysis inside the Application Security Testing report.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.