Application Security
CWE-597: Wrong Operator in a String Comparison
In Java, == on strings compares objects, not text. When that result feeds a security decision, a style slip becomes a vulnerability. What to use instead.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-595: Comparing Object References Instead of Contents
Using == on objects compares identity, not value, so equal objects look different. A classic Java bug that turns into a security bug when it guards a decision.
Oct 18, 20262 min read
Application Security
CWE-594: J2EE Sessions Holding Unserializable Objects
Under load, J2EE containers flush session objects to disk. If those objects are not Serializable, requests fail and data corrupts. How to avoid it.
Oct 18, 20262 min read
Application Security
CWE-593: OpenSSL CTX Changed After SSL Objects Exist
Modify an SSL_CTX after connections were created from it and older connections may be affected, including skipping authentication. Set the context up first.
Oct 18, 20262 min read
Application Security
CWE-591: Sensitive Data in Improperly Locked Memory
Keys and passwords held in memory the OS can swap to disk may outlive your process. Why mlock and VirtualLock are not the whole answer.
Oct 18, 20262 min read
Application Security
CWE-590 Free of Memory Not on the Heap: Causes and Fixes
Calling free() on a stack, global, or interior pointer corrupts the allocator and can give attackers a write primitive. See how it happens and how to stop it.
Oct 18, 20263 min read
Application Security
CWE-59 Link Following: How Symlink and Shortcut Attacks Work
CWE-59 is what happens when code opens a file by name and the name turns out to be a link to something else. Causes, checks and fixes.
Oct 18, 20267 min read
Application Security
CWE-589: Calling an API That Is Missing on Some Platforms
Some security functions exist only on newer OS versions, and others are removed for safety reasons. CWE-589 is what happens when code assumes they are always there.
Oct 18, 20262 min read
Application Security
CWE-588: Accessing a Field Through a Non-Structure Pointer Cast
Cast a plain variable to a struct and write to its fields, and you corrupt whatever sits next to it in memory. How CWE-588 happens and how to avoid it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.