Application Security
CWE-654 Reliance on a Single Factor in a Security Decision
If one stolen or spoofed factor unlocks everything, the whole control fails with it. Layer independent checks at more than one choke point.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-653 Improper Isolation or Compartmentalization
When privilege levels share one boundary, a bug in the low-privilege part becomes a bug in the high-privilege part. Split modules and guard the seams.
Oct 18, 20263 min read
Application Security
CWE-652 XQuery Injection: How It Works and How to Prevent It
Building XQuery strings from user input lets attackers change the query itself. Bind variables and validate input to keep data separate from logic.
Oct 18, 20262 min read
Application Security
CWE-651 Exposed WSDL Files and the Information They Leak
A publicly reachable WSDL can reveal private methods and deprecated services. Limit who can fetch it and keep internal names out of it.
Oct 18, 20262 min read
Application Security
CWE-650 Trusting HTTP Methods for Access Control
Assuming GET never changes state lets attackers modify or delete data through endpoints that only block POST, PUT and DELETE.
Oct 18, 20262 min read
Application Security
CWE-65 Windows Hard Link: What It Is and How to Prevent It
A program that opens files by name can be tricked into using a hard link to a sensitive target. CWE-65 is the Windows version of that mistake.
Oct 18, 20262 min read
Application Security
CWE-649 Obfuscated or Encrypted Inputs Without Integrity Checks
Encrypting or scrambling a client-side token does not stop tampering. Without an integrity check, attackers just search for a value that works in their favor.
Oct 18, 20263 min read
Application Security
CWE-648 Incorrect Use of Privileged APIs and How to Avoid It
Calling a privileged function with bad arguments, from a bad state, or without shedding privileges afterward hands attackers an escalation path.
Oct 18, 20264 min read
Application Security
CWE-647 Non-Canonical URL Paths in Authorization Decisions
Authorization checks that compare raw URLs miss equivalent forms like encoded characters or trailing slashes. Here is how the bypass works and how to close it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.