appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
596 articles
Static Code Scanning Tools: How to Choose and Use Them
Static code scanning tools read your source without running it to find bugs and security flaws. Here is how they work, where they fall short, and how to pick one.
Fixing XXE in Java: A Parser-by-Parser Hardening Guide
A parser-by-parser XXE fix for Java, covering DocumentBuilderFactory, SAXParser, XMLInputFactory, TransformerFactory, and the XML libraries that still ship unsafe defaults.
What Is a Product Security Assessment? A Practical Guide
A product security assessment is a structured evaluation of a product's design, code, dependencies, and deployment for exploitable weakness. Here is how to run one that finds real risk.
Choosing an npm XML Parser: Security Comparison and XXE Pitfalls
Not every npm XML parser carries the same risk. We compare xml2js, fast-xml-parser, sax, and libxmljs on their CVE history, XXE exposure, and safe configuration.
What Is a Cross-Site Request Forgery Vulnerability?
A cross-site request forgery vulnerability tricks a logged-in user's browser into sending unwanted requests. Here is how it works and how to shut it down.
Best Secrets Detection Tools: 2026 Buyer's Guide
A field comparison of the best secrets detection tools in 2026 across precision, secret variety, and CI integration for teams hardening their supply chain.
ASPM Security: Application Security Posture Management Explained
ASPM doesn't scan anything new — it aggregates and prioritizes findings your existing SAST, DAST, and SCA tools already produce, which is exactly the problem most AppSec teams actually have.
Bootstrapping a Secure Website Scan Workflow on a Budget
A small team can build a real scanning habit with zero budget — the trick is turning one-off checks into a repeatable workflow before traffic (and risk) grows.
DAST Meaning: What Dynamic Application Security Testing Actually Is
DAST stands for Dynamic Application Security Testing, a way of finding vulnerabilities by attacking a running application from the outside. Here is what that means in practice.
How Secure Code Reviews Catch Bugs Before Attackers Do
Code reviews are one of the cheapest security controls you have, but only if they look for the right things. Here is how to run secure code reviews that actually find vulnerabilities.
What a Static Application Security Test Catches (and What It Misses)
A clear-eyed look at the static application security test: how SAST works, the vulnerability classes it finds, its blind spots and false positives, and how to run it without drowning developers.
Types of Vulnerability Assessments and When to Use Each
Network, host, application, database, wireless, and cloud assessments each answer a different question. Knowing which type fits which risk is half the job.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.