Application Security
ASVS 5.0 V15.2.3: Ship Only What Production Needs
ASVS V15.2.3 says production must not expose test code, samples or dev tools. How to strip them at build time and prove it with an image scan.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V15.2.2: Defend Expensive Functions From Overload
ASVS V15.2.2 requires defenses for slow or resource heavy features so one request cannot take the service down. Timeouts, limits and queues, with tests.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V15.2.1: Keep Components Inside Fix Deadlines
ASVS V15.2.1 asks that no shipped component has outlived your documented update and fix deadlines. Here is how to write the policy and enforce it in CI.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V15.1.5: Document Dangerous Functionality in Code
ASVS 5.0 V15.1.5 (Level 3): record where the app uses dangerous functionality such as eval, deserialization or shell calls, with owners and safeguards.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V15.1.4: Flag Risky Third Party Components
ASVS 5.0 V15.1.4 (Level 3): document which libraries count as risky components, and why. Criteria, a register format and how to check it.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V15.1.3: Document Resource Heavy Functionality
ASVS 5.0 V15.1.3 (Level 2): list the slow or expensive features and how you stop them from taking the app down. Queues, limits and timeouts with code.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V15.1.2: Maintain an SBOM and Trusted Sources
ASVS 5.0 V15.1.2 (Level 2): keep an inventory such as an SBOM of every third party library and verify it comes from trusted repositories.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V15.1.1: Set Risk Based Patch Time Frames
ASVS 5.0 V15.1.1 (Level 1): document how fast you fix vulnerable third party components and update libraries. A workable policy and how to prove it.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V14.3.3: Keep Sensitive Data Out of Browser Storage
ASVS 5.0 V14.3.3 (Level 2): localStorage, sessionStorage, IndexedDB and cookies may hold session tokens but not other sensitive data. How to comply.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.