Application Security
CWE-385 Covert Timing Channel: When Timing Leaks Secrets
How long an operation takes can reveal what it did. CWE-385 explained with plain examples and the fixes MITRE recommends for removing time variance.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-384 Session Fixation: How It Happens and How to Fix It
If login keeps the old session ID, an attacker who planted it owns the session. CWE-384 explained with Java and Python fixes and the checks that catch it.
Oct 18, 20265 min read
Application Security
CWE-383 J2EE Bad Practices: Direct Use of Threads in Web Apps
Creating your own threads inside a J2EE container invites deadlocks and races the container cannot manage. CWE-383 explained with the recommended framework approach.
Oct 18, 20262 min read
Application Security
CWE-382 J2EE Bad Practices: Use of System.exit() in a Web App
Calling System.exit() inside a J2EE app shuts down the whole container. CWE-382 explained, with the Java pattern and how to remove it.
Oct 18, 20262 min read
Application Security
CWE-38 Backslash Absolute Path Traversal Explained
CWE-38 is the backslash form of absolute path traversal. A short guide to what it is, where it hides and how to close it.
Oct 18, 20262 min read
Application Security
CWE-379 Temporary File in a Directory With Insecure Permissions
Even a well protected temp file leaks information if its directory is open to everyone. CWE-379 explained with three real CVE patterns and plain fixes.
Oct 18, 20262 min read
Application Security
CWE-378 Temporary File With Insecure Permissions: Causes and Fixes
A temp file readable or writable by other users leaks data and gives attackers a trusted input. CWE-378 explained, with the Java createTempFile case and fixes.
Oct 18, 20263 min read
Application Security
CWE-377 Insecure Temporary File: How It Happens and How to Fix It
Temp files with default permissions or predictable names leak data and invite tampering. CWE-377 explained with Java and Python fixes and a real library example.
Oct 18, 20264 min read
Application Security
CWE-375 Returning a Mutable Object to an Untrusted Caller
A getter that returns its internal list lets every caller rewrite your state. CWE-375 explained with a short Java example and the clone-before-return fix.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.