Application Security
CWE-345 Insufficient Verification of Data Authenticity
CWE-345 is accepting data without proving where it came from. Unsigned firmware and weak checksums show the damage, and signatures show the way out.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-344 Invariant Value in a Changing Context: Why It Bites
CWE-344 covers code that hardcodes a name, path or reference that should change per environment. Here is how it shows up and how to design it out.
Oct 18, 20263 min read
Application Security
CWE-343 Predictable Value Range from Previous Values
A generator whose past outputs narrow down the next one shrinks the work of brute force. CWE-343 explained in brief.
Oct 18, 20262 min read
Application Security
CWE-342 Predictable Exact Value from Previous Values
When earlier outputs let an attacker compute the next one exactly, spoofing follows. CWE-342 explained with the classic TCP sequence number cases.
Oct 18, 20262 min read
Application Security
CWE-341 Predictable from Observable State: Values Built From Time and PID
Values derived from time, process ID or other observable state can be reconstructed by an attacker. CWE-341 explained with a recent e-commerce case.
Oct 18, 20262 min read
Application Security
CWE-340 Predictable Numbers or Identifiers: Guessable by Design
Sequential ports, timestamped filenames and PRNG outputs that leak state all make identifiers guessable. CWE-340 explained with MITRE's observed cases.
Oct 18, 20262 min read
Application Security
CWE-34 Path Traversal with '....//' and Sequential Filter Collapse
Filter out dot-dot-slash in one pass and '....//' turns back into it. How CWE-34 works, why sequential removal is unsafe, and how to check the resolved path instead.
Oct 18, 20266 min read
Application Security
CWE-339 Small Seed Space in a PRNG: Brute-Forcing the Seed
If a generator can start from only a few seeds, an attacker can try them all and predict every later output. CWE-339 explained with the Java RandomStringUtils case.
Oct 18, 20262 min read
Application Security
CWE-338 Cryptographically Weak PRNG: Use a CSPRNG for Secrets
rand(), Math.random() and mt_rand() are fine for games and unsafe for tokens. CWE-338 shows how weak generators end up in security code and how to replace them.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.