static-analysis
Safeguard articles tagged "static-analysis" — guides, analysis, and best practices for software supply chain and application security.
170 articles
Code Quality Analysis and Security: Why Clean Code Is Safer Code
Code quality analysis and security testing overlap more than teams realize. Here is how measuring quality catches whole classes of vulnerabilities early.
Free SAST Tools: The Best Open Source Scanners to Start With
The best free SAST tools include Semgrep, CodeQL, Bandit, and gosec. Here is what each one is good at and how to assemble a no-cost static analysis stack that actually catches bugs.
Static Code Scanning Tools: How to Choose and Use Them
Static code scanning tools read your source without running it to find bugs and security flaws. Here is how they work, where they fall short, and how to pick one.
Code Quality Scanning: What It Catches and Why Security Cares
Code quality scanning and security scanning overlap more than most teams realize. Here is what static analysis of code quality actually finds and how to run it without alert fatigue.
Securing Your Vue Project with eslint-plugin-vue
eslint-plugin-vue is the official linter for Vue single-file components. It is not a security scanner, but used well it removes whole classes of bugs that turn into vulnerabilities.
Semgrep Open Source: What It Scans and How to Use It Well
Semgrep open source is a fast, rule-based static analysis engine for finding bugs and security issues. Here is what the free CLI covers and where its limits are.
Dataflow Analysis in Modern Codebases
Dataflow analysis is the workhorse behind most vulnerability research. Here's how it adapts to TypeScript, Rust, and the polyglot realities of modern software.
Reachability Analysis: Cutting Through Vulnerability Noise
Not every vulnerability in your dependencies is exploitable. Safeguard's reachability analysis determines whether vulnerable code paths are actually invoked in your application.
SAST Meaning and Full Form: Static Application Security Testing Explained
SAST stands for Static Application Security Testing — analyzing source code for vulnerabilities without running it. Here is what the term means, how it works, and where it fits alongside DAST and SCA.
Static Analysis False-Positive Reduction
A technique-by-technique tour of how modern static analyzers cut false positives, from CodeQL's path pruning to Infer's bi-abduction.
SAST Tool Accuracy Benchmarks 2024: What the Data Actually Shows
Static Application Security Testing tools vary dramatically in accuracy. We analyze detection rates, false positive rates, and language coverage across leading SAST tools using standardized benchmarks.
Taint Analysis for Zero-Day Discovery: A Primer
A practitioner's walk-through of taint analysis as a zero-day discovery technique, from classic Livshits and Lam foundations to modern flow-sensitive engines.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.