Application Security
CWE-50 Multiple Leading Slash Path Equivalence: Causes and Fixes
A request starting with two slashes can read arbitrary files or skip authentication. CWE-50 explained, with a normalization fix.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-5 J2EE Data Transmission Without Encryption: Causes and Fixes
A J2EE app configured to send data in plaintext lets anyone on the network path read or change it. Here is how the weakness shows up and how to close it.
Oct 18, 20262 min read
Application Security
CWE-499 Serializable Class Containing Sensitive Data in Java
A Java class that holds secrets and does not deny serialization can be written to a byte stream by any other class. Learn the pattern and the two standard fixes.
Oct 18, 20262 min read
Application Security
CWE-498 Cloneable Class With Sensitive Data: Cause and Fix
A class that holds secrets but allows cloning can be copied without running its constructor. Here is how that bypasses checks and how to close it off in Java, C++ and C#.
Oct 18, 20262 min read
Application Security
CWE-497 Exposure of Sensitive System Information: Find and Fix
Stack traces, paths and version banners help attackers plan. How system information leaks out of web apps and the logging and error handling that stops it.
Oct 18, 20265 min read
Application Security
CWE-496 Public Data Assigned to a Private Array-Typed Field
Storing a caller's array in a private field keeps the caller's handle on it. Copy the array on the way in so the private field stays private.
Oct 18, 20262 min read
Application Security
CWE-495 Private Data Structure Returned From a Public Method
A getter that hands back a reference to a private array or list lets callers change your internal state. Return copies or read only views instead.
Oct 18, 20262 min read
Application Security
CWE-494 Download of Code Without Integrity Check: Fixes
Software that fetches and runs code without verifying it trusts the network and the host. Learn how signing and verification close the gap in updates and installers.
Oct 18, 20264 min read
Application Security
CWE-493 Critical Public Variable Without Final Modifier
A public field that is not final can be rewritten by any code that reaches the class. Make critical fields final, or stop exposing them.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.