appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
591 articles
Fixing XXE in Java: A Parser-by-Parser Hardening Guide
A parser-by-parser XXE fix for Java, covering DocumentBuilderFactory, SAXParser, XMLInputFactory, TransformerFactory, and the XML libraries that still ship unsafe defaults.
What Is a Cross-Site Request Forgery Vulnerability?
A cross-site request forgery vulnerability tricks a logged-in user's browser into sending unwanted requests. Here is how it works and how to shut it down.
Choosing an npm XML Parser: Security Comparison and XXE Pitfalls
Not every npm XML parser carries the same risk. We compare xml2js, fast-xml-parser, sax, and libxmljs on their CVE history, XXE exposure, and safe configuration.
What Is a Product Security Assessment? A Practical Guide
A product security assessment is a structured evaluation of a product's design, code, dependencies, and deployment for exploitable weakness. Here is how to run one that finds real risk.
Bootstrapping a Secure Website Scan Workflow on a Budget
A small team can build a real scanning habit with zero budget — the trick is turning one-off checks into a repeatable workflow before traffic (and risk) grows.
DAST Meaning: What Dynamic Application Security Testing Actually Is
DAST stands for Dynamic Application Security Testing, a way of finding vulnerabilities by attacking a running application from the outside. Here is what that means in practice.
How Secure Code Reviews Catch Bugs Before Attackers Do
Code reviews are one of the cheapest security controls you have, but only if they look for the right things. Here is how to run secure code reviews that actually find vulnerabilities.
What a Static Application Security Test Catches (and What It Misses)
A clear-eyed look at the static application security test: how SAST works, the vulnerability classes it finds, its blind spots and false positives, and how to run it without drowning developers.
Types of Vulnerability Assessments and When to Use Each
Network, host, application, database, wireless, and cloud assessments each answer a different question. Knowing which type fits which risk is half the job.
SQL Injection Demo: How the Attack Works and How to Stop It
A practical SQL injection demo that shows how unsanitized input reaches the database, why it works, and the one fix that reliably closes the hole.
SSRF Full Form: What Server-Side Request Forgery Means
The SSRF full form is Server-Side Request Forgery, a vulnerability where an attacker tricks your server into making requests on their behalf. Here is what that means and how to defend against it.
Website Security Scan: What It Checks and How to Run One
A website security scan tests a live site for common weaknesses. Here is what the different scan types actually check, how to read the results, and where the free ones fall short.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.