Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
ASVS V11.7.2 asks you to expose the least data possible while processing and to encrypt it again as soon as you can. Patterns for shrinking plaintext lifetime.
ASVS V11.7.1 asks for full memory encryption that protects sensitive data while it is processed. What confidential computing offers and how to verify it.
ASVS V11.6.2 requires approved key exchange algorithms with secure parameters, to stop adversary in the middle attacks. Prefer ECDHE with named curves.
ASVS V11.6.1 requires approved algorithms for key generation and signing, and keys that are not weak, like RSA keys open to Fermat factorization. How to comply.
ASVS V11.5.2 asks that your random number source keeps working securely under heavy demand. Use the OS CSPRNG, avoid custom pools, and test at scale.
ASVS V11.5.1 requires non guessable values from a CSPRNG with at least 128 bits of entropy, and says UUIDs do not qualify. Safe code for four languages.
ASVS V11.4.4 requires approved key derivation with stretching when you turn a password into an encryption key. PBKDF2, scrypt and Argon2id settings explained.
ASVS V11.4.3 sets hash output minimums: 256 bits when collision resistance matters, 128 bits for second preimage only. Check signatures and integrity checks.
ASVS V11.4.2 requires passwords stored with an approved slow password hashing function and sensible parameters. Argon2id, scrypt, bcrypt and PBKDF2 compared, with code.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
