Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CWE-344 covers code that hardcodes a name, path or reference that should change per environment. Here is how it shows up and how to design it out.
A generator whose past outputs narrow down the next one shrinks the work of brute force. CWE-343 explained in brief.
When earlier outputs let an attacker compute the next one exactly, spoofing follows. CWE-342 explained with the classic TCP sequence number cases.
Values derived from time, process ID or other observable state can be reconstructed by an attacker. CWE-341 explained with a recent e-commerce case.
Sequential ports, timestamped filenames and PRNG outputs that leak state all make identifiers guessable. CWE-340 explained with MITRE's observed cases.
Filter out dot-dot-slash in one pass and '....//' turns back into it. How CWE-34 works, why sequential removal is unsafe, and how to check the resolved path instead.
If a generator can start from only a few seeds, an attacker can try them all and predict every later output. CWE-339 explained with the Java RandomStringUtils case.
rand(), Math.random() and mt_rand() are fine for games and unsafe for tokens. CWE-338 shows how weak generators end up in security code and how to replace them.
Seeding a generator from the clock or process ID shrinks the search space to a handful of guesses. CWE-337 explained, including the Debian OpenSSL case.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
