Application Security
CWE-187 Partial String Comparison: How Prefix Matches Go Wrong
Comparing only part of a value, like a prefix or first character, can let a short password or sibling path pass. CWE-187 explained with fixes.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-186 Overly Restrictive Regular Expression: Missed Matches
A pattern that matches less than you intended fails to flag dangerous values. How CWE-186 works, using MITRE's /[0-8]/ example.
Oct 18, 20262 min read
Application Security
CWE-185 Incorrect Regular Expression: Anchors, Nulls and Bypasses
A regex that is not anchored, or that fails on odd input, can let spoofed values through. How CWE-185 happens and how to write validation patterns that hold.
Oct 18, 20263 min read
Application Security
CWE-184 Incomplete List of Disallowed Inputs: Why Denylists Fail
A denylist that misses one character or path form is a bypass waiting to happen. CWE-184 explained, with recent AI platform examples and fixes.
Oct 18, 20263 min read
Application Security
CWE-183 Permissive List of Allowed Inputs: When Allowlists Leak
An allowlist only protects you if everything on it is truly safe. How CWE-183 shows up in sandboxes and CI pipelines, and how to tighten it.
Oct 18, 20263 min read
Application Security
CWE-182 Collapse of Data into Unsafe Value: Causes and Defenses
Removing dangerous sequences from input can collapse the remainder into a new dangerous sequence. How CWE-182 works and how to defend against it.
Oct 18, 20262 min read
Application Security
CWE-181 Validate Before Filter: How Filtering Recreates Attacks
A filter that strips characters after validation can assemble the very pattern the check was meant to block. CWE-181 explained.
Oct 18, 20262 min read
Application Security
CWE-180 Validate Before Canonicalize: The Order That Breaks Checks
Checking a path or name before it is reduced to its canonical form lets tricks like fakechild/../realchild through. How CWE-180 works and the fix.
Oct 18, 20262 min read
Application Security
CWE-179 Early Validation: Why Order of Operations Matters
Validating input before canonicalizing or cleansing it lets attackers build dangerous values after the check. How CWE-179 works and how to reorder.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.