appsec
Safeguard articles tagged "appsec" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Search Your Wiki for the Word Password Right Now
A database credential pasted into a setup guide, an API key in a runbook written during an outage, a shared vendor login on a page titled useful links. Nobody put it there to be careless, and it has been searchable ever since.
An Idempotency Key That Only Checks Prior Receipt Protects Nothing
A client retries a timed-out payment request. Both copies arrive close together, both pass the check for whether the key exists, because neither has finished processing yet, and both charge the card.
postMessage Has No Default Access Control
Your embeddable widget talks to the page hosting it across origins. Anything that can get a reference to that window can send it a message, and unless the listener checks who sent it, the widget will act on a message from anywhere.
A Poisoned Memory Outlives the Conversation That Created It
Prompt injection in a single turn affects one response, then the next request starts clean. A persistent memory feature breaks that boundary by design, so a single successful injection becomes durable, recalled and trusted in every future session.
Your Feature Flag Targeting Rules Are Visible in the Browser
To evaluate flags locally, the client-side SDK needs the targeting rules: which accounts get the enterprise preview, the pricing tier conditions, the churn-risk exclusions. Open the network panel and anyone can read all of it.
Deleting the Line Does Not Delete the Secret From Git History
A scanner flags a credential from fourteen months ago, removed in the very next commit. The current file is clean, which feels like the problem is solved. The blob holding that value is still reachable from the earlier commit.
Which Timing Differences Actually Matter
Extracting a secret from microsecond differences across the internet is genuinely hard. A response that takes 120ms when an account exists and 3ms when it does not needs no statistics at all.
What Your Identifiers Tell the World
A random identifier is not an access control. What identifier design does affect is discovery, inference and what leaks when a URL travels, and a sequential integer in a URL publishes your customer count.
Your API Returns More Than Your Interface Shows
The interface filters. The API does not. Serialising a model directly makes your API contract your database schema, so a column added for an internal feature is exposed the moment it is added.
What Leaves Your Application When a User Clicks a Link
The address of the page they were on, and sometimes a handle that lets the destination navigate your tab. Both are defaults, both are one attribute away from fixed, and your URLs contain identifiers and sometimes capabilities.
Your Application's Hostname Should Not Be an Input
To build a reset link your app needs to know its own hostname, and the convenient place to find it is the Host header. That header is supplied by the client, so a stranger decides what goes in the email you send.
Your Old API Version Is Still Serving and It Did Not Get the Fix
You shipped v2 with a tightened authorisation check. v1 is still live because nobody knows who calls it. An attacker does not have to use v2.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.