Safeguard
Tag

sast

Safeguard articles tagged "sast" — guides, analysis, and best practices for software supply chain and application security.

371 articles

Application Security

AI Writes Code Faster Than You Can Review It. Which Scanner Do You Point at It?

AI-generated code arrives faster than review can absorb and fails in distinct patterns. SAST, DAST, and reachability each catch part of that — and each misses a specific, predictable slice.

Aug 9, 20266 min read
Vulnerability Analysis

Open redirect vulnerabilities explained

Open redirect flaws (CWE-601) score as medium severity alone, but they power real phishing campaigns against Google, Amex, and Microsoft. Here's how they work and how to stop them.

Aug 3, 20267 min read
Vulnerability Analysis

Type confusion vulnerabilities explained

Type confusion bugs let attackers corrupt memory by exploiting mismatched type assumptions. See real CVEs, how JIT engines fail, and how to catch it early.

Aug 2, 20266 min read
Vulnerability Analysis

Format string vulnerabilities explained

Format string bugs let attackers turn a printf call into memory disclosure or arbitrary writes. Here's how CWE-134 works, real CVEs, and fixes.

Aug 2, 20266 min read
AppSec

Code Security Scanners: Choosing One for Your Stack

The right code security scanner depends less on which vendor's marketing sounds best and more on language coverage, false-positive rate, and whether it fits into the workflow developers already use.

Jul 28, 20265 min read
AppSec

Code Security Scan: How to Scan Your Code for Vulnerabilities

A code security scan analyzes your source and its dependencies for security flaws before they ship. Here is how the main scan types work, what tools to use, and how to wire scanning into CI without drowning in noise.

Jul 25, 20267 min read
Security

How to Choose Vulnerability Assessment Solutions That Actually Reduce Risk

Most vulnerability assessment solutions generate more findings than any team can fix. The right choice depends on what you're protecting — code, dependencies, containers, or infrastructure.

Jul 22, 20267 min read
Security

Semgrep Pricing Explained: Free, Team, and Enterprise Tiers

Semgrep pricing is built around a free tier, a per-contributor Team plan, and custom Enterprise quotes. Here is how the tiers break down and what to watch for.

Jul 18, 20266 min read
Application Security

Comparing open-source tools for secure Java code review

SpotBugs checks 400+ bug patterns, Find Security Bugs adds 144 more, and CodeQL needs a full build — no single free Java scanner covers everything.

Jul 16, 20266 min read
DevSecOps

Secure SDLC: A Practical Guide to Embedding Security Gates in Every Phase

NIST finalized the Secure Software Development Framework in February 2022, yet most teams still bolt security on at release. Here's where the gates actually belong.

Jul 16, 20267 min read
Application Security

Trojan Source: how Unicode bidi control characters hide malicious code in plain sight

CVE-2021-42574 scored 8.3 CVSS for a bug that isn't a parser flaw at all — it's Unicode's bidirectional text algorithm, weaponized against code review.

Jul 16, 20266 min read
Application Security

Code injection risks in CLI tools and IDE plugins

A malicious npm dependency hid in event-stream for 8M downloads before detection. Developer tooling is a code-injection blast radius most teams never audit.

Jul 15, 20266 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

sast — Safeguard Blog