Application Security
ASVS 5.0 V11.4.1: Stop Using MD5 for Crypto
ASVS V11.4.1 allows only approved hashes for signatures, HMAC, KDFs and random bit generation, and bans MD5 for any cryptographic purpose. Find and replace it.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V11.3.5: Use Encrypt Then MAC Order
ASVS V11.3.5 requires that any encryption plus MAC combination runs in encrypt then MAC order. Prefer AEAD so you never choose the order yourself.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V11.3.4: Never Reuse a Nonce or IV
ASVS V11.3.4 requires single use numbers such as nonces and IVs to be unique per key and data element, generated the right way for the algorithm. Patterns that hold up.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V11.3.3: Authenticate Your Encrypted Data
ASVS V11.3.3 requires encrypted data to resist tampering, preferably with authenticated encryption. Why CBC alone is not enough and how to use AEAD with context.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V11.3.2: Use Only Approved Ciphers and Modes
ASVS V11.3.2 requires approved ciphers and modes such as AES with GCM. A short allow list, safe defaults for Node and Go, and a test that catches drift.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V11.3.1: Ban ECB and PKCS#1 v1.5 Padding
ASVS V11.3.1 forbids insecure block modes like ECB and weak padding like PKCS#1 v1.5. See what to use instead, with code, and how to catch offenders in review.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V11.2.5: Make Crypto Modules Fail Securely
ASVS V11.2.5 wants crypto errors handled so they never help an attacker, as in padding oracle attacks. Return one generic failure and log the detail privately.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V11.2.4: Make Crypto Comparisons Constant Time
ASVS V11.2.4 requires constant time crypto operations with no short circuit comparisons. Use compare_digest and friends, and test for timing differences.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V11.2.3: Keep 128 Bits of Security Minimum
ASVS V11.2.3 says every cryptographic primitive needs at least 128 bits of security. What that means for RSA, ECC, AES and hashes, and how to check your config.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.