AppSec
API Scanner Tools: What to Look For
An API scanner tool needs to do more than replay a Postman collection against your endpoints. Here's what actually separates a useful API scanner from one that generates noise.
Jun 20, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
Vulnerability Scanner Tools: how they work
A breakdown of how SAST, DAST, SCA, and container vulnerability scanner tools actually work, where Veracode fits, and why false positives remain the industry's biggest problem.
Jun 20, 20267 min read
Open Source
Angular Compiler Security: What @angular/compiler-cli Handles and How to Keep It Safe
The Angular compiler is more than a build step — it enforces your template sanitization contract, and a 2025 XSS bug proved that assumption can break.
Jun 20, 20266 min read
Application Security
AWS IAM permissions boundaries best practices
How AWS IAM permissions boundaries cap delegated identities, differ from SCPs, and where teams get privilege escalation wrong.
Jun 20, 20267 min read
DevSecOps
What Is a DevOps Pipeline? Stages, Tools, and Security Gates
A DevOps pipeline is the automated path code takes from commit to production. Here are the stages every pipeline shares, the tools teams actually use, and where security gates belong.
Jun 20, 20265 min read
Application Security
Web Application Security Standards overview
A breakdown of OWASP, NIST SSDF, and PCI DSS 4.0 web application security standards, where Veracode's scanning model covers them, and where supply-chain gaps remain.
Jun 20, 20267 min read
DevSecOps
Shift-Left Security Testing in Practice
Shift-left security testing means catching vulnerabilities at commit time instead of at deployment — here's what that actually looks like on a working pipeline, not just the slogan.
Jun 20, 20265 min read
Vulnerabilities
OpenJDK Vulnerabilities: Tracking and Patching
OpenJDK vulnerabilities are disclosed and patched through Oracle's quarterly Critical Patch Update cycle, but tracking them well means watching your specific JDK distribution and version line, not just assuming a generic update covers you.
Jun 20, 20265 min read
Application Security
Top 10 Azure security risks and prevention
Real Azure breaches — BlueBleed, ChaosDB, OMIGOD, Midnight Blizzard — trace back to storage misconfigs, identity sprawl, and exposed secrets, not zero-days.
Jun 20, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.