Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
When a function needs strong or recent authentication, check acr, amr and auth_time from the IdP, or document a fallback that assumes the weakest method. Level 2.
SAML assertions must be consumed once within their validity period to stop replay. Track assertion IDs, check conditions, and test it. Level 2.
JWTs and SAML assertions must be checked for a valid signature every time, and unsigned ones rejected. Safe code for JWT and SAML, tests, and mistakes. Level 2.
With several identity providers, key users by IdP ID plus the user ID at that IdP so one provider cannot impersonate an account from another. Level 2.
Cryptographic authentication challenges need a nonce of at least 64 bits that is statistically unique. Generation, storage and tests. Level 3.
Certificates used to verify authentication assertions must be stored so nobody can modify them. Storage options and tests. Level 3.
MFA push approvals need rate limits so attackers cannot spam a user into tapping Approve. Number matching helps. Design, code and tests. Level 3.
Code based out of band authentication needs rate limiting against brute force, and ideally 64 bit codes. A working limiter, tests, and mistakes. Level 2.
An out of band code must work only for the login attempt that created it, never an earlier or later one. Implementation and tests. Level 2.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
