Application Security
ASVS 5.0 V6.2.5: Drop Password Composition Rules
Do not force uppercase, digits or symbols. Allow any characters and reward length instead. Level 1 guide with validation code, tests and mistakes to avoid.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V6.2.4: Block the Top 3000 Passwords
Check new passwords against at least the 3000 most common ones that fit your policy. Level 1 guide with a loading pattern, tests and common mistakes.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V6.2.3: Require Current Password to Change It
A password change must ask for both the current and the new password, so a hijacked session cannot lock the owner out. Level 1 guide with code and tests.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V6.2.2: Let Users Change Their Password
Users must be able to change their own password. Without it, a suspected compromise has no clean fix. Level 1 requirement with implementation notes and tests.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V6.2.12: Check New Passwords Against Breaches
Reject passwords that appear in known breach data at registration and change. k anonymity lookup code, tests and pitfalls. Level 2 requirement.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V6.2.11: Enforce the Context Word List
Use your documented organization specific words list to reject easy guesses at password creation. Level 2 guide with matching code and tests.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V6.2.10: Do Not Force Periodic Password Rotation
Passwords should stay valid until compromised or changed by the user. Scheduled expiry weakens real world security. Level 2 guide with policy and test notes.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V6.2.1: Set a Real Minimum Password Length
Require at least 8 characters, and ideally 15 or more, for user chosen passwords. Skip composition rules. Level 1 guide with server side code and tests.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V6.1.3: Document Every Authentication Pathway
List every way a user can sign in, with the controls and strength each must enforce. Hidden pathways are where attackers go. Level 2 requirement.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.