Software and Data Integrity Failures
Failing to verify the integrity of software, updates, or data, for example in CI/CD pipelines and unsafe deserialization.
What are Software & Data Integrity Failures?
This category happens when an app accepts important code or data without confirming its authenticity. Examples include installing unsigned software updates, pulling dependencies from an untrusted source, or deserializing objects from users. The gist: something that should be intact and trusted can be quietly altered by an attacker. Try the update scenario in the demo tabs.
Updates without signature verification
Many apps update themselves automatically. If an update package is installed without verifying the publisher's digital signature, an attacker who can get in the middle (a fake mirror, hijacked DNS, a compromised CI/CD pipeline) can inject malicious code that then installs with full privileges. The fix: sign packages and verify that signature against a trusted public key before installing.
Insecure deserialization
Deserialization turns data (e.g. from a cookie or request) back into an object. If that data is untrusted and the format allows it, an attacker can craft an object that triggers code execution when read. Treat all serialized data from outside as untrusted: use simple data formats, validate strictly, and avoid deserializing arbitrary object types.
Impact & prevention
Integrity failures can lead to remote code execution and full system takeover, often spreading through the supply chain to many victims at once. The principle: never trust code or data just because it 'seems' to come from the right source. Verify signatures, pin dependency integrity (lockfile + checksums), and secure the build pipeline.