Application Security
CWE-511 Logic and Time Bombs: Code That Waits to Strike
A logic or time bomb disrupts a product when a date passes or a condition is met. Why it evades tests, and how code coverage helps you find it.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-510 Trapdoor: Hidden Code That Skips Authentication
A trapdoor responds to a special input and grants access without normal security checks. How to hunt for it in source and binaries, and how to reduce the risk.
Oct 18, 20262 min read
Application Security
CWE-51 Multiple Internal Slash Path Equivalence
Doubled slashes inside a path can produce a second name for the same file. A short look at CWE-51 and how to normalize safely.
Oct 18, 20262 min read
Application Security
CWE-509 Replicating Malicious Code: Viruses, Worms and Your Supply Chain
Viruses and worms spread to other systems after compromising one. What CWE-509 covers, why dependencies matter, and the checks MITRE recommends.
Oct 18, 20263 min read
Application Security
CWE-508 Non-Replicating Malicious Code: Meaning and Defense
Non-replicating malicious code stays on the system it attacks and does not spread. Learn what that means for scope, impact and your install-time checks.
Oct 18, 20262 min read
Application Security
CWE-507 Trojan Horse in Software: What It Is and How to Defend
A Trojan horse looks useful but hides behavior that breaks the user's security policy. Here is how it reaches you and the checks that help.
Oct 18, 20262 min read
Application Security
CWE-506 Embedded Malicious Code: Detecting Backdoors in Software
Malicious code can hide in a few lines of a trusted product or dependency. How it gets in, what it can do, and the review methods MITRE rates as useful.
Oct 18, 20265 min read
Application Security
CWE-502 Deserialization of Untrusted Data: Causes and Fixes
Turning untrusted bytes back into objects can run attacker-chosen code. How pickle, YAML, PHP and Java deserialization go wrong, and the fixes that hold up.
Oct 18, 20265 min read
Application Security
CWE-501 Trust Boundary Violation: Mixing Trusted and Untrusted Data
When trusted and untrusted values share one data structure, unvalidated input gets treated as safe. Learn how it happens and how to keep the line clear.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.