appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Your Logs Are the Least Protected Copy of Your Most Sensitive Data
Nobody writes log.info(password). The leaks come from logging whole request bodies, exception objects, header maps and serialised domain objects, into a store replicated everywhere and retained for a year.
A Clean Scan Usually Means the Scanner Did Not Look
Analysed your code and found nothing, or failed to analyse your code and therefore found nothing. Most tools report both as success. Seven reasons coverage collapses, and the canary dependency that proves a scan still works.
Four Silent Ways a Rate Limiter Permits Everything
A forgeable key, a per-instance counter, a fail-open catch block and a fixed window all produce a limiter that runs, logs, appears on the architecture diagram, and blocks nothing. None shows up in the usual test.
When NULL Tenant Means Global, Forgetting the Tenant Means Disclosure
A nullable tenant_id where NULL means global makes omission the unsafe state, and SQL NULL semantics mean the mistake never raises an error. The admin view looks full and correct while tenant-scoped rows are simply absent.
Changing Scanners Means Migrating Three Years of Triage Decisions
Findings regenerate. Suppressions, risk acceptances, severity overrides and exclusion scope do not. The composite key that matches most of them, what should not carry over, and the sequence that keeps the review queue before cutover.
Evaluate a Security Scanner in Three Weeks, Not Six Months
A standard bake-off measures detection on code both tools have seen, weights forty rows equally, and tests week one of a week-fifty problem. Six questions with real variance, and how to run them against your incumbent too.
Your App Issues Two Kinds of Token and One Verifier Only Knows One
An SSO user carries your auth service's token, not your identity provider's. A verifier that accepts only the provider's tokens rejects exactly the users it was built for, and the symptom is a button that does nothing.
Five Places Reachability Analysis Says Unreachable and Is Wrong
Reachability is the best noise filter in dependency scanning and its failure mode is silence, not an error. The five cases where the call graph is incomplete, and what to do about each.
Second-Order SQL Injection Is the Bug Class a Scanner Should Refuse to Test
For a stored injection, confirming the bug and exploiting it are the same action. That is a property of the vulnerability, not a gap in anyone's product, and it changes what you should ask a DAST vendor.
A Scanner's Scope Guard Belongs in Code, Not in a Config File
The difference between a security test and an unauthorised attack is permission on the target. If that boundary is a setting, then a typo, a redirect or a merged config is all it takes to cross it.
Authenticated DAST: Getting Past the Login Without Wrecking the App
Most of an application is behind a session, so an unauthenticated scan tests the login page and the marketing footer. Getting in is the easy half — staying in, and not clicking Delete Account, is the rest.
What Tree-sitter Taint Analysis Actually Catches (and What It Cannot)
Following untrusted data from source to sink across a real codebase is a solved problem right up until reflection, dynamic dispatch and an ORM turn up. Knowing where the analysis stops is what makes it usable.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.