Application Security
CWE-639 Authorization Bypass Through User-Controlled Key (IDOR)
Change an ID in a URL and read someone else's record. How CWE-639 works, how to test for it and how to enforce ownership on every lookup.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-638 Not Using Complete Mediation: Check Every Access
If access is checked once and cached, revoked users keep their rights. Mediate every access to a protected resource through one place.
Oct 18, 20263 min read
Application Security
CWE-637 Unnecessary Complexity in Protection Mechanisms
Security mechanisms that are more complicated than they need to be get misunderstood, misconfigured and bypassed. Economy of mechanism explained with real cases.
Oct 18, 20265 min read
Application Security
CWE-636 Not Failing Securely: Why Fail-Open Designs Hurt
When a security check errors out and the system falls back to the weakest option, attackers only need to cause the error. Design for fail-safe, not fail-functional.
Oct 18, 20263 min read
Application Security
CWE-628 Function Call With Incorrect Arguments Explained
Wrong argument order, count, type or value turns a correct function into an insecure one. Usually obvious, unless it sits on a rarely tested path.
Oct 18, 20262 min read
Application Security
CWE-627 Dynamic Variable Evaluation: Risks and Fixes
When users influence the name of a variable or function at runtime, they can read, write or call things you never meant to expose. Allowlist names or avoid the feature.
Oct 18, 20263 min read
Application Security
CWE-626 Poison Null Byte: How a NUL Breaks Your Checks
A null byte ends a string in C but not in PHP or Perl. Attackers use that gap to cut off file extensions and slip past regex checks.
Oct 18, 20262 min read
Application Security
CWE-625 Permissive Regular Expression: Anchor Your Patterns
A regex that matches a substring instead of the whole value lets bad input through. See the common mistakes, a real exploited case and how to fix them.
Oct 18, 20265 min read
Application Security
CWE-624 Executable Regular Expression Error in PHP and Perl
A regex that can execute code, or lets a user switch execution on, turns a text match into remote code execution. Quote user input before it enters a pattern.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.