Application Security
ASVS 5.0 V6.6.1: Handle SMS and Phone OTP With Care
SMS and voice one time codes need validated numbers, stronger alternatives and risk notices, and are not allowed at Level 3. Level 2.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V6.5.8: Check TOTP Against a Trusted Time Source
Verify TOTP codes using server side time from a trusted service, never a client supplied timestamp. Clock handling, drift and tests. Level 3.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.5.7: Biometrics Only as a Secondary Factor
Biometric checks must pair with something you have or something you know and never stand alone. What that means in practice. Level 3.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.5.6: Revoke Any Authentication Factor After Loss
Every authentication factor, including physical devices, must be revocable when lost or stolen. How to design revocation and test it. Level 3.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.5.5: Lifetimes for OOB Codes, Tokens and TOTP
Out of band requests live at most 10 minutes and TOTP codes at most 30 seconds. How to enforce lifetimes server side and test them. Level 2.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.5.4: Minimum Entropy for Recovery and OOB Codes
Lookup secrets and out of band codes need at least 20 bits of entropy: about six random digits or four alphanumeric characters. Level 2.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.5.3: Generate MFA Secrets With a CSPRNG
Recovery codes, OOB codes and TOTP seeds must come from a cryptographically secure random generator. Examples in four languages and how to test. Level 2.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V6.5.2: Hash Lookup Secrets Stored on the Backend
Recovery codes below 112 bits of entropy need a salted password hash. At 112 bits or more a standard hash works. Code and tests. Level 2.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.5.1: Lookup Secrets, OOB Codes and TOTP Work Once
Recovery codes, out of band codes and TOTP codes must succeed only once. How to enforce single use correctly, including races, and how to test it. Level 2.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.