appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
591 articles
Java URLEncode: How to Encode URLs Safely in Java
Java urlencode is usually URLEncoder.encode, but it is built for form bodies, not full URLs. Here is when to use it and when it introduces bugs.
Android Application Security Solutions That Reduce Real Risk
Android application security solutions span secure storage, network hardening, code protection, and dependency scanning. Here is what each layer covers and how iOS compares.
JavaScript Injection Attacks: Types and Prevention
JavaScript injection covers a family of attacks where untrusted input becomes executable code or markup in the browser. Here are the types and the concrete defenses for each.
LDAP Injection Attacks: How They Work and How to Prevent Them
LDAP injection lets an attacker manipulate directory-service queries by inserting special filter characters into user input, often bypassing authentication entirely — here's how the attack works and how to stop it.
SAST and DAST Full Form: What the Acronyms Actually Mean
The SAST and DAST full form is Static and Dynamic Application Security Testing. Here is what each one does, where they differ, and when to use both.
Stored XSS Explained: A Security Guide
Stored XSS is the persistent, high-impact form of cross-site scripting where a malicious script is saved server-side and served to every visitor. Here is how to detect and stop it.
XXE Attack Example: How XML External Entity Injection Works and How to Stop It
A defensive XXE attack example that explains how XML External Entity injection abuses parsers, what it can expose, and the parser settings that shut it down.
The Snyk Logo: The Story Behind Patch the Guard Dog
The Snyk logo is a friendly Doberman named Patch, and the choice of a guard dog says more about the company's positioning than a wordmark ever could.
What Is Snyk Code? A Guide to the SAST Often Misspelled "Synk Code"
"Synk Code" is a common misspelling of Snyk Code, Snyk's developer-first SAST engine. Here is what it scans, how DeepCode AI works, and where it fits.
Why We Use CORS in Node.js: Configuration Without the Foot-Guns
Understanding why we use CORS in Node.js starts with what it is not: CORS is a browser relaxation mechanism, not a security wall. Here is how to configure it in Express without the classic misconfigurations.
Secure Code Review: A Practical Checklist
Secure code reviews catch a different category of bug than functional code review, and having a repeatable checklist keeps reviewers from relying on memory for the same handful of recurring flaws.
iOS App Security Testing: A Practical Guide for Mobile Teams
iOS app security testing means checking storage, transport, and third-party code, not just trusting the App Store review. Here is how to do it well.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.