Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
ASVS V9.2.1 (Level 1): if a token has a validity period, only accept it inside that window. Check exp and nbf, set small clock skew, and test with expired tokens.
ASVS V9.1.3 (Level 1): signing keys come from pre-configured trusted sources. Ignore jku, x5u and jwk headers unless they match an allowlist.
ASVS V9.1.2 (Level 1): only allowlisted algorithms may create or verify tokens, with no None algorithm. Stop alg confusion with fixed settings and tests.
ASVS V9.1.1 (Level 1) says self-contained tokens such as JWTs must have their signature or MAC verified before any claim is used. Code and tests.
ASVS V8.4.2 (Level 3): admin interfaces need several layers, including continuous identity checks and device posture, not just a network location.
ASVS V8.4.1 (Level 2) requires controls so one tenant's operations can never affect another tenant. Row scoping, tests and the mistakes that cause leaks.
ASVS V8.3.3 (Level 3): downstream services should decide access using the original caller's permissions, not an intermediary's service account.
ASVS V8.3.2 (Level 3): when a user's rights change, the change must take effect now. If tokens delay it, add alerting and rollback. Patterns and tests.
ASVS V8.3.1 (Level 1) says authorization must be enforced in a trusted service layer, never in client-side JavaScript. How to do it and how to prove it.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
