AppSec
Semgrep SCA: How Reachability Changes Dependency Scanning
What Semgrep SCA (Supply Chain) does, how its reachability analysis cuts alert noise, where it fits, and how to run it in CI.
Oct 7, 20256 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAppSec
An XSS Example That Explains How Cross-Site Scripting Works
A clear XSS example shows how unescaped user input becomes executable script in a victim's browser, and why output encoding and CSP are the fixes that hold.
Oct 7, 20257 min read
AppSec
DAST Vendors Compared: Picking a Dynamic Scanning Tool
Choosing among DAST vendors hinges on how well the scanner authenticates, crawls modern apps and APIs, and fits into CI without turning into a manual chore.
Oct 6, 20255 min read
AppSec
DAST Automated Testing: How It Works and Why It Belongs in CI
A DAST automated test probes your running application for vulnerabilities the way an attacker would, on every build. Here is how it works and the benefits of wiring it into CI.
Oct 6, 20256 min read
AppSec
SQL Injection Detected: What the Alert Means and How to Respond
A SQL injection detected alert means a scanner or WAF found input reaching your database as executable code. Here is how to confirm it, triage it, and fix the root cause.
Oct 2, 20257 min read
AppSec
URL Scanner: How It Works and What to Use
A URL scanner checks a web address for danger before you visit or ship it — but 'URL scanner' covers two very different tools. Here is how each works and which one solves your problem.
Oct 2, 20256 min read
AppSec
Security in PHP: Framework-Level Protections and Common Gaps
Security in PHP improved enormously once frameworks took over escaping, CSRF, and query building. The remaining incidents live in the gaps where developers step outside those rails.
Sep 30, 20256 min read
AppSec
Code Scanning Tools: How to Choose and Use One That Works
A code scanning tool automatically inspects your source and dependencies for vulnerabilities. Here is how the main types differ and how to wire one into CI without drowning in noise.
Sep 30, 20256 min read
AppSec
Java Code Security: A Practical Checklist
Java code security has a specific set of recurring failure modes — deserialization, XXE, dependency sprawl — this checklist covers the ones worth checking on every review.
Sep 25, 20255 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.