Safeguard
Tag

dast

Safeguard articles tagged "dast" — guides, analysis, and best practices for software supply chain and application security.

123 articles

Application Security

AI Writes Code Faster Than You Can Review It. Which Scanner Do You Point at It?

AI-generated code arrives faster than review can absorb and fails in distinct patterns. SAST, DAST, and reachability each catch part of that — and each misses a specific, predictable slice.

Aug 9, 20266 min read
Application Security

Your DAST Scanner Was Built to Crawl Links. Your Application Doesn't Have Any.

Classic DAST discovers attack surface by following hyperlinks. In an estate of APIs and serverless functions there is nothing to crawl, so the scan completes, reports clean, and covers little.

Aug 9, 20266 min read
Compliance

Medtronic and AdaptHealth: The Third Party Was the Vulnerability

3.8 million people notified by Medtronic. PII, PHI and insurance billing credentials exfiltrated at AdaptHealth after social engineering against a third-party contractor. Neither breach needed a software vulnerability — both needed a trusted outsider with a session.

Jul 28, 20266 min read
Application Security

Polymarket Lost ~$3M Without a Single Smart Contract Bug

On 25–26 June 2026 attackers compromised a third-party vendor and injected malicious code into Polymarket's website frontend, manipulating users into approving fraudulent transactions. Roughly $3M in crypto drained. The smart contracts were never touched. Your client-side dependency tree is production.

Jul 28, 20266 min read
DevSecOps

A framework for consolidating SAST, DAST, and SCA tools

Enterprises run 45 security tools on average, and 50+ tool stacks detect incidents 8% worse. Here's when AppSec consolidation actually pays off.

Jul 15, 20266 min read
AppSec

Vulnerability Scanners and the Gartner AST Landscape: How the Tools Actually Work

When people search for a vulnerability scanner in the Gartner sense, they usually mean the AST market. Here is what that market covers, how the tool types work, and how to choose.

Jul 15, 20266 min read
Application Security

API security fundamentals: mapping the OWASP API Top 10 to real tests

OWASP's 2023 API Security Top 10 lists 10 risk categories — most start with a single curl request. Here's how to test and fix each one.

Jul 13, 202611 min read
AppSec

Black Box Fuzzing, Explained

Black box fuzzing throws malformed input at a running application with zero knowledge of its internals, and it still finds crashes and memory bugs white box testing misses — here's how it works and where it fits in a security program.

Jul 11, 20266 min read
AppSec

ZAP Scanner: How OWASP ZAP Works and When to Use It

ZAP is the most widely used free DAST scanner. Here is how its spider, passive, and active engines work, where it fits in CI, and its honest limits.

Jul 11, 20267 min read
Security

The ZAP Security Testing Tool: A Practical Guide

How the ZAP security testing tool works as a free DAST scanner: passive and active scanning, the spider and AJAX spider, and how to run it in CI without noise.

Jul 10, 20266 min read
AppSec

Web Application Scanning: Tools and Methods Compared

Web application scanning ranges from free automated crawlers to full authenticated DAST pipelines — here's how the methods differ and when each is enough.

Jul 10, 20265 min read
AppSec

Dynamic Scanning, Explained for Engineers Who Aren't Security Specialists

Dynamic scanning tests a running application the way an attacker would, by sending it requests and watching what comes back. Here's what that actually involves and when it's the right tool.

Jul 9, 20266 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

dast — Safeguard Blog