Application Security
CWE-267 Privilege Defined With Unsafe Actions: Dangerous Roles
CWE-267 is a role or capability that can do unsafe things even when given to the right person. Learn to scope privileges to what they need.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-266 Incorrect Privilege Assignment: How It Happens and Fixes
CWE-266 is giving an actor a privilege it should not have. Real examples include untrusted users in the wheel group. Here is how to spot and prevent it.
Oct 18, 20263 min read
Application Security
CWE-263 Password Aging With Long Expiration: What to Do Instead
CWE-263 covers password aging policies where the expiry window is too long. Here is why that matters, why shorter is not automatically better, and what to do.
Oct 18, 20263 min read
Application Security
CWE-262 Not Using Password Aging: Rotation, Compliance and Trade-offs
CWE-262 flags products with no password aging mechanism. MITRE also notes why rotation has fallen out of favor, and where it is still required.
Oct 18, 20265 min read
Application Security
CWE-261 Weak Encoding for Password: Base64 Is Not Protection
Obscuring a password with base64 or a similar encoding protects nothing. CWE-261 covers why and what to do instead.
Oct 18, 20263 min read
Application Security
CWE-260 Password in Configuration File: Moving Secrets Out of Config
A password in a config file is readable by anyone who can read the file, including backups and repos. CWE-260 explains the risk and safer alternatives.
Oct 18, 20265 min read
Application Security
CWE-26 Path Traversal with '/dir/../filename': How Filters Fail
A path that starts clean and climbs out later slips past prefix checks. How CWE-26 works, with real cases from MITRE and a safe resolve-then-compare fix.
Oct 18, 20263 min read
Application Security
CWE-259 Use of Hard-coded Password: Inbound, Outbound and the Fix
A password baked into code or firmware is shared by every copy and almost impossible to change. CWE-259 covers both variants and how to avoid them.
Oct 18, 20265 min read
Application Security
CWE-258 Empty Password in Configuration File
A blank password in a config file is an open door that looks like a lock. CWE-258 covers how it gets there and how to catch it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.