appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
100 articles
From policy to production: defining guardrails once and enforcing them everywhere
Define a guardrail once on the Policy page, compile it into a signed policy bundle, and enforce it with one line of middleware in Node.js, Python, Java, Go and .NET. A walkthrough of how Guard installs and runs.
Runtime guardrails inside your app: what library-level protection catches that a WAF can't
A WAF sees a request, not the SQL query it turns into. How query-structure SQL checks, SSRF checks on resolved IPs, LLM and MCP guardrails, Monitor mode and fail-open work inside the application.
We Signed CISA's Secure by Design Pledge. Here Is Where We Stand on Each Goal
Safeguard now appears on CISA's list of Secure by Design Pledge signers. The pledge asks for measurable progress on seven security goals within a year. Here is what we already ship for each one, and what we have not done yet.
Soft-Deleted Records Are Still Reachable
A soft delete sets a flag and leaves the row in place, which means every single query, export, search index, and cache that touches that table has to remember to exclude it. One that does not is a path where a user's deletion was never actually honored.
A Link Is Fetched Before Anyone Clicks It
Paste a URL into a chat message and a server fetches it automatically to build a preview card, before anyone reads the message or clicks anything. That fetch consumes a single-use link or a time-limited token just as effectively as the intended recipient would have.
Your Access Review Checks One Node in a Graph
A user's permission listing shows no administrative access. By every direct check, they are ordinary. They can still become an administrator through a permission that looks unrelated, was granted for an unrelated reason, and lets them modify something that leads there.
Just-in-Time Provisioning Moves Trust From a Person to a Claim in a Token
A new employee signs in with SSO for the first time, and your application creates an account and assigns a role based on group claims from the identity provider, with no human in the loop to notice if the claim maps to more access than intended.
Two Correct Parsers Can Disagree About the Same Multipart Request
A duplicate field name, an unusual boundary, a malformed header. Two standards-compliant parsers can resolve the same ambiguous bytes differently, and if a validator reads one interpretation while your application reads another, validation passed something it never actually checked.
Nobody Chose to Fail Open. The Catch Block Did.
A permission check that throws, times out, or returns something unexpected proceeds as though access were granted, because a broad catch block written to handle an operational problem silently became an authorization bypass.
An Uploaded File Can Be Two Formats at Once, and Your Validation Only Checked One
A user's file passes every image validation check your upload handler runs. It is also, independently and simultaneously, a valid HTML document, and browser MIME sniffing can choose to render that instead when your response headers do not stop it.
Account Linking by Email Match Trusts a Claim, Not a Verification
Continue with Google links to the matching existing account by email address. That is correct when the identity provider genuinely verified the email. Some providers make verification optional, and not every system checks which claim it is reading.
The Permission You Just Revoked, According to a Replica That Has Not Heard Yet
A user is removed from a project. The write succeeds on the primary immediately. For the next several hundred milliseconds, a read replica still shows them as a member, and if any authorization check reads from it, they can still act.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.