access-control
Safeguard articles tagged "access-control" — guides, analysis, and best practices for software supply chain and application security.
60 articles
Building Automation Security: The OT Category Facilities Teams Deploy Outside IT's View
HVAC, access control, and elevator systems increasingly share a building's IP network — procured and maintained by facilities teams with limited coordination with conventional IT security.
Oracle's WebLogic Proxy Plug-in Bug Sat at CVSS 10.0 for Seven Months Before Confirmed Exploitation
CVE-2026-21962, an access control failure in the Oracle HTTP Server / WebLogic Server Proxy Plug-in, went from January disclosure to August KEV confirmation — seven months later.
PaperCut Has Two More Confirmed-Exploited CVEs, After Its 2023 Ransomware History
PaperCut MF/NG, previously exploited at scale by ransomware affiliates in 2023, had two more vulnerabilities confirmed exploited on the same day in 2026 — an access control failure and unsafe class loading.
Authentication bypass vulnerabilities explained
Authentication bypass flaws let attackers skip login entirely. See how CVE-2022-40684, CVE-2023-22515, and CVE-2021-40539 were exploited and prevented.
Privilege escalation vulnerabilities explained
Privilege escalation vulnerabilities turn a low-privilege foothold into root or admin access. Learn how they work, key CVEs, and how to detect them.
Application Data Security: How to Protect Data Across Its Lifecycle
Application data security is the set of controls that protect data as your application collects, processes, stores, and transmits it. Here is a practical model for getting it right.
Security considerations for deploying and querying vector...
Vector databases now hold copies of your most sensitive data with weaker controls than the systems they came from. Here's what to fix before your next RAG deployment.
Project Quay Improper Access Control Exposing Private Ima...
CVE-2020-27838 exposed private container images in Project Quay due to improper access control. Here's what happened, who's affected, and how to remediate it.
RBAC vs. ABAC vs. ReBAC: choosing an access-control model for multi-tenant cloud apps
Google's Zanzibar paper (USENIX ATC 2019) showed relationship graphs authorizing access with sub-10ms latency at massive scale — here's when RBAC or ABAC beats it instead.
The OWASP Top 10:2025, explained with minimal fix-it code
OWASP reordered its Top 10 for 2025 — Broken Access Control is back at #1 and a new Mishandling of Exceptional Conditions category debuts at #10.
A hardening checklist for modern Drupal deployments
Drupal 7's 2025 end-of-life left unsupported sites exposed; here's a concrete checklist for module vetting, access control, and patch cadence on Drupal 10/11.
Why traditional AppSec still catches most enterprise AI agent bugs
OWASP's LLM Top 10 names new categories, but most enterprise agent breaches trace back to broken access control and unvalidated input — the classics.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.