Application Security
ASVS 5.0 V6.4.6: Admins Start Resets, Never Choose Passwords
Administrators may trigger a user's password reset but must never set or know the new password. How to build it and test it. Level 3.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V6.4.5: Remind Users Before Authenticators Expire
Authentication mechanisms that expire, like certificates and tokens, need renewal instructions sent early with automated reminders. Level 3.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.4.4: Identity Proofing When an MFA Factor Is Lost
Recovering a lost MFA factor needs identity proofing as strong as enrollment. What that means for support flows and how to test it. Level 2.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.4.3: Password Reset That Does Not Bypass MFA
A forgotten password flow must not skip multi-factor authentication. How to build a reset that keeps the second factor in force and how to test it. Level 2.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.4.2: No Password Hints or Secret Questions
Password hints and knowledge based questions like 'first pet' must not exist. Why they fail, what to use instead, and how to check. Level 1.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.4.1: Secure Initial Passwords and Activation Codes
System generated first passwords and activation codes must be random, policy compliant, short lived or single use, and never become the long term password. Level 1.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V6.3.8: Do Not Reveal Which Users Exist
Login, registration and password reset must not reveal whether an account exists, through messages, status codes or response timing. Level 3, with code and tests.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V6.3.7: Notify Users When Credentials Change
Send a notice after a password reset, username change or email change so owners can spot takeovers fast. Level 3 guide with code and tests.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V6.3.6: Do Not Use Email as an Auth Factor
Email codes and links must not serve as a single or additional authentication factor. Level 3 guide with alternatives, tests and mistakes.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.