Application Security
In-depth guides and analysis on application security from the Safeguard engineering team.
100 articles
How do we handle a flood of AI-generated vulnerability reports?
Require a working reproducer, check shipped versions and reachability first, handle low severity in public, and turn valid reports into tested fixes.
Can an AI Model Do a Real Security Review of My Code?
Yes, for part of the job. AI review finds real bugs, but trust only findings with a proof and fixes with a fail before, pass after test. Here is how.
WAF vs API gateway: what each does and when you need both
A WAF inspects HTTP traffic for known attack patterns. An API gateway manages access, routing and limits. Learn what each covers and where both fall short.
What is different about managing TypeScript dependencies securely?
TypeScript projects carry runtime code and type packages. Learn how to separate them, review @types, and know what skipLibCheck hides from you.
Threat modeling vs risk assessment: what is the difference?
Threat modeling asks what can go wrong in a design. Risk assessment ranks risks across an organization. Teams need both, and each feeds the other.
How do you generate secure random numbers and encrypt data in Swift?
Use the system generator or SecRandomCopyBytes for secrets, prefer CryptoKit to low-level APIs, never reuse a nonce, and avoid the Insecure algorithms.
What belongs on a secure coding checklist for Ruby and Rails teams?
Twelve code review checks for Ruby teams, from eval and html_safe to open redirects, file paths, sessions and gem updates, each with a smell to search for.
Secure random numbers and cryptography basics in Scala
Use java.security.SecureRandom for tokens and keys in Scala, never a seeded generator, and let a maintained library handle AES modes, IVs and key storage.
How should Kotlin applications handle secrets and API keys?
In Kotlin, keep secrets out of the repository, assume anything shipped in an Android app can be extracted, and use Keystore, scoped keys and a backend.
What security baseline should a new Google Cloud account have?
Set up an organization, folders, groups, org policy constraints, central logging and private networking before the first workload. A GCP starter baseline.
Can a Flutter web app have XSS, and how do you prevent it?
Flutter widgets show strings as text, but HTML embeds, raw DOM calls and link schemes can allow XSS. Find the sinks, use text APIs, validate URLs, add CSP.
Where do secrets go in a Dart and Flutter app?
Dart's dart-define values are compiled into the app and hide nothing. Learn what belongs there, what to keep on a server, and what to rotate.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.