Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
ASVS 5.0 V12.3.2 (Level 2): every TLS client must validate the server certificate. Find and remove verify=False, InsecureSkipVerify and friends.
ASVS 5.0 V12.3.1 (Level 2): use TLS or another encrypted protocol for databases, SSH, middleware, monitoring and partner links, with no plaintext fallback.
ASVS 5.0 V12.2.2 (Level 1): external facing services need certificates from a publicly trusted CA. Automate issuance and renewal, and test the chain.
ASVS 5.0 V12.2.1 (Level 1) requires TLS for all client connections to external HTTP services with no fallback to plain HTTP. Redirects, HSTS and tests.
ASVS 5.0 V12.1.5, Level 3: enable Encrypted Client Hello so the server name is not visible in the TLS handshake. What it needs and how to check it.
ASVS 5.0 V12.1.4 is a Level 3 requirement: enable certificate revocation checking such as OCSP stapling and verify it actually works.
ASVS 5.0 V12.1.3 (Level 2): verify an mTLS client certificate chains to a trusted CA before using its identity for authentication or authorization.
ASVS 5.0 V12.1.2 (Level 2) asks you to enable only recommended cipher suites, strongest first, and forward secrecy only at Level 3. Config and tests inside.
ASVS V12.1.1 requires only current TLS versions, 1.2 and 1.3, with the newest preferred. Server configs for nginx and Node, plus a scan that proves it.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
