Application Security
CWE-245 J2EE Bad Practices: Managing Connections Yourself
CWE-245 flags J2EE code that opens its own database connections instead of using the container's pooled resources. It is a quality weakness.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
CWE-244 Heap Inspection: Clearing Secrets Before realloc and free
realloc() can leave a copy of a password or key in memory you can no longer reach. CWE-244 explains heap inspection and how to scrub secrets.
Oct 18, 20263 min read
Application Security
CWE-243 chroot Jail Without Changing Working Directory
Calling chroot() without a following chdir() leaves the working directory outside the jail, so relative paths can still reach the real filesystem.
Oct 18, 20263 min read
Application Security
CWE-242 Use of Inherently Dangerous Function: gets() and Friends
Some C and C++ functions cannot be used safely however carefully you call them. CWE-242 covers gets(), banned function lists and how to enforce them.
Oct 18, 20265 min read
Application Security
CWE-241 Unexpected Data Type: When a Letter Shows Up Where a Digit Belongs
CWE-241 is code that breaks when an element is not the expected type. Strict allowlist validation is the fix MITRE points to.
Oct 18, 20263 min read
Application Security
CWE-240 Inconsistent Structural Elements: The Root of Heartbleed
When two parts of an input should agree but do not, code that trusts one of them goes wrong. CWE-240 includes the length mismatch behind Heartbleed.
Oct 18, 20263 min read
Application Security
CWE-24 Path Traversal with '../filedir': The Canonical Escape
The plain dot-dot-slash is the classic path traversal. A walkthrough of CWE-24, why it still works, how to test for it, and how to fix it in several languages.
Oct 18, 20265 min read
Application Security
CWE-239 Failure to Handle Incomplete Element: Hangs from Partial Requests
A request that never finishes can hold a server hostage. CWE-239 covers incomplete elements and the denial of service they cause.
Oct 18, 20262 min read
Application Security
CWE-238 Incomplete Structural Elements: Half-Formed Input
CWE-238 is input that stops partway through a structure, like a truncated message. Parsers that assume completeness crash or hang.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.