Application Security
ASVS 5.0 V8.2.4: Adaptive Controls Based on Context
ASVS V8.2.4 (Level 3) wants authentication and authorization decisions to react to time, location, IP and device, at login and during the session.
Oct 18, 20262 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V8.2.3: Restrict Access to Individual Fields (BOPLA)
ASVS V8.2.3 says users may only read or write the object fields they have explicit permission for. Here is how to enforce it in an API and how to test for it.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V8.2.2: Stop IDOR and BOLA With Per Object Checks
ASVS V8.2.2 requires data access limited to consumers with explicit rights to specific items. Scope queries by owner, deny by default and test with two accounts.
Oct 18, 20265 min read
Application Security
ASVS 5.0 V8.2.1: Restrict Function Level Access to Explicit Permissions
ASVS V8.2.1 requires function level access only for consumers with explicit permissions. Deny by default, enforce on the server and test every route as every role.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V8.1.4: Document Contextual Access Decisions
ASVS V8.1.4 asks you to document how context feeds decisions: attributes, risk thresholds and the action taken, from allow to step up to deny.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V8.1.3: Document Contextual Security Attributes
ASVS V8.1.3 wants a list of the environmental signals your app uses for security decisions, such as time, location, IP and device. Write them down and own them.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V8.1.2: Document Field Level Access Rules
ASVS V8.1.2 asks for written rules on which fields each consumer can read and write, including rules that depend on object state. A matrix does the job.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V8.1.1: Document Function and Data Access Rules
ASVS V8.1.1 requires written authorization rules for function level and data specific access. Build a permission matrix, keep it testable and tie it to code.
Oct 18, 20264 min read
Application Security
ASVS 5.0 V7.6.2: Require User Action to Create a Session
ASVS V7.6.2 says an app must not create a session silently. Require consent or a click, especially with SSO and login CSRF in mind.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.