Application Security
CWE-615 Sensitive Information in Source Comments: Find and Fix
Comments that leak file paths, old links, usernames or code fragments hand attackers a map of your application. Strip them before release.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-614 Cookie Without the Secure Attribute: Fix Guide
A session cookie without the Secure flag can travel over plain HTTP and be sniffed. See how it happens, how to test it in seconds, and how to set the flag.
Oct 18, 20263 min read
Application Security
CWE-613 Insufficient Session Expiration: Tokens That Never Die
Sessions and tokens with no expiry stay valid after theft, logout, or a password change. How CWE-613 happens and the fix MITRE recommends.
Oct 18, 20263 min read
Application Security
CWE-612: Improper Authorization of an Index With Sensitive Data
A search index of private documents can leak what the documents protect. Why index access needs the same access control as the originals.
Oct 18, 20262 min read
Application Security
CWE-611 XXE: How XML External Entities Leak Files and Fix
An XML parser that resolves external entities can read local files, make server-side requests, and burn CPU. How XXE works and the parser settings that stop it.
Oct 18, 20264 min read
Application Security
CWE-610: Externally Controlled Reference to Another Sphere
When a user-supplied name or reference resolves to a resource outside its intended boundary, access control quietly fails. The parent of path traversal, open redirect, and more.
Oct 18, 20263 min read
Application Security
CWE-61 UNIX Symbolic Link Following: Causes, Checks, Fixes
Symlink following lets a local attacker redirect a privileged program's file access. How CWE-61 works and how to open files safely.
Oct 18, 20265 min read
Application Security
CWE-609 Double-Checked Locking: Why the Classic Pattern Fails
Double-checked locking tries to skip synchronization, but other threads may see half-built objects. What goes wrong in Java and the safe ways to do lazy initialization.
Oct 18, 20263 min read
Application Security
CWE-608: Struts ActionForm Fields That Are Not Private
A non-private field in a Struts ActionForm bypasses getters and setters and can be read or changed outside the framework's flow. The simple fix.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.