Application Security
CWE-606: Unchecked Input Used as a Loop Condition
When a packet or request decides how many times a loop runs, a crafted value can pin a CPU. How CWE-606 shows up in parsers and what to do about it.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-605: Multiple Binds to the Same Port and Stolen Traffic
Letting several sockets bind one port can let a local process steal packets or impersonate your service. What SO_REUSEADDR really allows and how to limit it.
Oct 18, 20262 min read
Application Security
CWE-603 Client-Side Authentication: Why the Server Must Decide
When the login check lives in client code, a modified client just skips it. Why authentication must happen on the server, with real examples from MITRE.
Oct 18, 20263 min read
Application Security
CWE-602: Client-Side Enforcement of Server-Side Security
If the server trusts the browser or app to enforce a rule, an attacker simply changes the client. Why every check must be repeated on the server.
Oct 18, 20264 min read
Application Security
CWE-601 Open Redirect: How It Happens and How to Fix It
An open redirect turns your trusted domain into a launchpad for phishing and OAuth theft. How the bug works, how to test for it, and how to fix it properly.
Oct 18, 20265 min read
Application Security
CWE-600: Uncaught Exceptions in a Java Servlet
A servlet that lets an exception escape can send stack traces, query text, and version details to the browser. Catch everything and show a plain error.
Oct 18, 20262 min read
Application Security
CWE-6 J2EE Insufficient Session ID Length: Risk and Fix
Short session IDs are easier to guess, and a guessed ID is a stolen session. What CWE-6 means for Java apps and what to check.
Oct 18, 20262 min read
Application Security
CWE-599: Missing Validation of an OpenSSL Certificate
Trusting a certificate without calling SSL_get_verify_result lets a spoofed host pass as a trusted one. What to check in OpenSSL client code.
Oct 18, 20262 min read
Application Security
CWE-598 Sensitive Query Strings: Why Secrets Don't Belong in URLs
Passwords and tokens in a GET query string end up in logs, history, and referrer headers. How CWE-598 happens, what it leaks, and how to move secrets out of the URL.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.