Application Security
CWE-328 Use of Weak Hash: Why MD5 and SHA-1 Fail and What to Use
Weak hashes allow preimage, second preimage and collision attacks. CWE-328 explained, with a clear path to adaptive hashing for passwords.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-327 Broken or Risky Cryptographic Algorithms: A Practical Guide
MD5, SHA-1, DES and homemade ciphers still turn up in production. CWE-327 explains why they are risky and how to migrate to algorithms that hold up.
Oct 18, 20264 min read
Application Security
CWE-326 Inadequate Encryption Strength: When Good Crypto Is Too Weak
An encryption scheme can be sound in theory and still too weak for the data it protects. CWE-326 explained, with the steps that keep key sizes and schemes current.
Oct 18, 20262 min read
Application Security
CWE-325 Missing Cryptographic Step: Encryption Weaker Than Advertised
Skipping one required step in a cryptographic algorithm quietly weakens the whole thing. A short guide to CWE-325, its impact and how to avoid it.
Oct 18, 20262 min read
Application Security
CWE-324 Using a Key Past Its Expiration Date: Risk and Fixes
Old keys give attackers more time to crack or steal them. CWE-324 covers products that keep using cryptographic keys or passwords after they should have been replaced.
Oct 18, 20262 min read
Application Security
CWE-323 Reusing a Nonce, Key Pair in Encryption: What Goes Wrong
A nonce is meant to be used once. CWE-323 covers code that reuses a nonce with the same key, opening the door to replay and tampering.
Oct 18, 20263 min read
Application Security
CWE-322 Key Exchange Without Entity Authentication Explained
Encrypting a channel is not the same as knowing who is on the other end. CWE-322 covers key exchanges that skip identity checks and invite impersonation.
Oct 18, 20262 min read
Application Security
CWE-321 Hard-coded Cryptographic Keys: How to Find and Remove Them
A key written into code cannot be changed and is shared by every copy of the product. See how CWE-321 appears in real devices and how to replace embedded keys.
Oct 18, 20263 min read
Application Security
CWE-32 Path Traversal with the Triple Dot '...' Sequence
On some Windows systems three dots act like two parent hops, and filters that expect only two dots miss it. How CWE-32 works and how to fix it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.