appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
596 articles
Website Security Scan: What It Checks and How to Run One
A website security scan tests a live site for common weaknesses. Here is what the different scan types actually check, how to read the results, and where the free ones fall short.
SSRF Full Form: What Server-Side Request Forgery Means
The SSRF full form is Server-Side Request Forgery, a vulnerability where an attacker tricks your server into making requests on their behalf. Here is what that means and how to defend against it.
SQL Injection Demo: How the Attack Works and How to Stop It
A practical SQL injection demo that shows how unsanitized input reaches the database, why it works, and the one fix that reliably closes the hole.
NoSQL Injection: A Practical Tutorial
NoSQL databases don't use SQL syntax, but they're not immune to injection attacks — this NoSQL injection tutorial covers how the attack actually works against MongoDB-style queries.
What Is a Secure Development Model? A Practical Guide
A secure development model bakes security into every phase of building software instead of bolting it on at the end. Here is how the model works and how to adopt one without slowing delivery.
Application Security Automation: What to Automate First
Automation pays off in a strict order: dependencies, secrets, static analysis, then dynamic testing. Here is the sequence, why it works, and what should stay manual.
What Is a Security Champions Program?
AppSec teams are outnumbered 100 to 1 by developers. A security champions program is the only staffing model that scales — here is how to build one that lasts.
Java Vulnerability Classes: A Reference List
A java vulnerability list organized by class — deserialization, injection, XXE, and the rest — because Java's ecosystem produces a specific, recurring set of vulnerability patterns worth knowing by name.
IAST Security: Interactive Application Security Testing Explained
IAST security instruments a running application to watch real requests flow through real code, catching vulnerabilities that static analysis and black-box scanning both miss.
Choosing an Enterprise Security Solution: What Actually Matters
An enterprise security solution is less about a single flagship product and more about how well a set of controls integrates, scales, and produces evidence for auditors.
DAST Solutions: How to Choose the Right Dynamic Testing Tool
DAST solutions test a running application from the outside to find exploitable flaws. Here is how they work, what they catch, and how to evaluate one for your pipeline.
Types of Vulnerability Assessment, Explained
Not every vulnerability assessment tests the same thing. Here's how network, application, host, and wireless assessments differ, and when each one is the right call.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.