Application Security
What Is a CVE and How to Get One
A CVE is a unique ID for a publicly disclosed vulnerability. To get one, contact the CNA covering the product first, then MITRE as CNA of Last Resort.
Oct 18, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
security.txt: What It Is and How to Add One
security.txt is a small text file at /.well-known/security.txt that tells researchers how to report a vulnerability. RFC 9116 requires Contact and Expires.
Oct 18, 20264 min read
Application Security
How to Write a Vulnerability Disclosure Policy
Write a vulnerability disclosure policy in five parts: promise, scope, safe harbor, process and preferences. Sample text and response times from CISA and NTIA.
Oct 18, 20267 min read
Application Security
Bug Bounty vs Vulnerability Disclosure Program
A vulnerability disclosure program gives researchers a way to report issues. A bug bounty pays for valid ones. Key differences and which to start with.
Oct 18, 20265 min read
Application Security
How Often Should You Pen Test? What Standards Say
Pen test at least yearly and after any significant change. PCI DSS sets that floor, DORA sets every 3 years for threat-led tests, and NIST leaves it to you.
Oct 18, 20266 min read
Application Security
Penetration Testing vs Vulnerability Scanning Explained
A vulnerability scan finds known issues with automated tools. A penetration test tries to exploit them. NIST and PCI SSC say when and how you need each.
Oct 18, 20266 min read
Application Security
OWASP ASVS 5.0 Requirement Guides: Implement and Test
A guide to every OWASP ASVS 5.0 requirement, with how to implement it, how to test it and common mistakes.
Oct 18, 202618 min read
Application Security
Stopping AI-Enabled Exfiltration by Enterprise Agents (T1700)
A prompt-injected AI agent can send your data out using tools you approved. See what MITRE T1700 says and how to scope agents, data and destinations.
Oct 18, 20265 min read
Application Security
Direct Prompt Injection: Controls for AI Systems (T1699)
Typing "ignore your instructions" into an AI interface is a documented technique. See what MITRE T1699 says and how to keep prompts from granting authority.
Oct 18, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.