AppSec
Open Source SAST Tools Worth Evaluating
A rundown of the open source SAST tools engineering teams actually use in production, and where each one runs out of road.
Apr 26, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAppSec
Code Injection in Python: How It Happens and How to Prevent It
Code injection python vulnerabilities almost always trace back to eval, exec, or a template engine handed untrusted input; here is how the attack works and how to close it off.
Apr 26, 20266 min read
AppSec
org.apache.tomcat.embed: Embedded Tomcat Versions and Vulnerabilities
org.apache.tomcat.embed ships inside almost every Spring Boot jar, and its CVEs follow it there. Here is how to find your real embedded Tomcat version and patch it.
Apr 25, 20268 min read
AppSec
Static Code Analysis in Cyber Security: What It Actually Does
Static code analysis in cyber security means scanning source code without running it to catch injection flaws, hardcoded secrets, and unsafe patterns before they ship — here's what it catches and what it misses.
Apr 25, 20265 min read
AppSec
Website Vulnerability Scanners: How They Work and What They Miss
How a website vulnerability scanner crawls, fuzzes, and fingerprints your app, plus the whole classes of flaws it structurally cannot find on its own.
Apr 25, 20266 min read
AppSec
SAST Testing: How Static Analysis Finds Bugs Before They Run
A SAST test analyzes source code without executing it to find vulnerabilities like injection and hardcoded secrets. Here is how it works and where it fits.
Apr 25, 20266 min read
AppSec
Web Application Penetration Testing: What to Expect
A real web application penetration test follows a scoped, multi-phase process — here's what happens before, during, and after the engagement so the report doesn't surprise you.
Apr 24, 20265 min read
AppSec
IAST Meaning: What Interactive Application Security Testing Does
IAST instruments a running application from the inside, watching real execution to confirm vulnerabilities with far fewer false positives than static scanning.
Apr 24, 20266 min read
AppSec
CVSS 4.0 Release Date, Changes, and Adoption Status
The CVSS 4.0 release date was November 1, 2023 — here is what changed from v3.1, how the new metric groups work, and where real-world adoption stands.
Apr 23, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.