static-analysis
Safeguard articles tagged "static-analysis" — guides, analysis, and best practices for software supply chain and application security.
175 articles
The One Line of Ordinary Code That Kills a Taint Engine
param = decode(param) is as common as code gets. In a dataflow engine that resolves variables by looking backwards, it can recurse forever — and in Go the resulting stack overflow cannot be caught.
Reading an OWASP Benchmark Score Without Being Sold To
A tool that flags every test case scores 100% detection on the OWASP Benchmark. Recall is the number vendors quote and the one that means least — here is what the suite actually measures.
What Tree-sitter Taint Analysis Actually Catches (and What It Cannot)
Following untrusted data from source to sink across a real codebase is a solved problem right up until reflection, dynamic dispatch and an ORM turn up. Knowing where the analysis stops is what makes it usable.
Recall Is Easy. Your SAST Tool's Real Metric Is the Mute Rate
Any scanner can find every vulnerability by flagging everything. The number that decides whether a tool survives contact with a development team is how often it is wrong.
Running the OWASP Benchmark Against Your Own SAST Engine
A scanner with no measured accuracy is a scanner with claimed accuracy. Wiring up the OWASP Benchmark gives you one number that survives scrutiny — and usually finds a crash on the way.
Code Security Scan: How to Scan Your Code for Vulnerabilities
A code security scan analyzes your source and its dependencies for security flaws before they ship. Here is how the main scan types work, what tools to use, and how to wire scanning into CI without drowning in noise.
SAST Tooling: How to Choose and Run Static Analysis That Developers Trust
SAST tooling scans your source code for security flaws before it runs, but the tool you pick matters less than how you tune it. Here is how to choose, integrate, and keep the noise down.
Best SAST tools for enterprise applications
A practical buyer's guide comparing top SAST tools for enterprise apps -- strengths, limitations, and how Safeguard unifies findings across your pipeline.
Semgrep Pricing Explained: Free, Team, and Enterprise Tiers
Semgrep pricing is built around a free tier, a per-contributor Team plan, and custom Enterprise quotes. Here is how the tiers break down and what to watch for.
Java Error Checkers: Compilers, Linters, and Static Analysis
A guide to the Java error-checking stack — the compiler, linters like Checkstyle, bug finders like SpotBugs and Error Prone, and security scanners — and which one catches which class of problem.
The Benefits of Using SAST Tools During Code Review
The real benefit of using SAST tools during code review isn't finding more bugs than a human reviewer — it's finding the specific bugs humans consistently miss, before merge.
Insecure defaults in Azure ARM templates: a pre-deployment scanning guide
Azure Resource Manager templates don't enforce TLS 1.2 or block public blob access by default — here's how to catch it before terraform apply's Azure cousin ever runs.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.