I have a PCB that I'm sending off for assembly, which includes going through a reflow oven. The last batch had a problem because the solder mask on some PCBs does not completely insulate a via that is underneath a metal connector, resulting in a short. What can I safely use (that will withstand reflow temperatures) to paint or insulate the via to prevent the short?
You want to "tent" your vias. This means changing your DRC such that vias under a certain drill size will have solder mask extend over them.
If you are using Eagle, this is accomplished by changing the "Limit" value on the Masks tab of the DRC. The limit specifies what size drill hit that the solder mask should cover up to.
Check out the tutorial from Sparkfun on better PCB's.
I went ahead and used Kapton tape for this batch.
I also found that the industrial Sharpie pro permanent marker is rated to 500°F, so I might experiment with that later.
If you already have PCBs made without the benefit of a tented via, as you've indicated in comments, the only option that comes to mind is a wave solder masking tape (such as this one made by 3M).
...CW3300G is a green-tinted acrylic conformal coating. Acrylic conformal coating is applied to the finished circuit board to protect board components from moisture and provide electrical insulation between circuit traces. CW3300G is not an epoxy resist material and does not have the same properties of durability and permanence as a permanent solder resist. It will decompose at temperatures above 270 °F, and therefore should only be applied to the board after all soldering has been done.
Therefore, it should not be used to cover the via prior to wave soldering.
But this does provide a clue: epoxy. The solder mask is an epoxy or epoxy-acrylate coating, so it might be possible to find a similar coating available as an epoxy dispenser of some sort, though I have not seen (and was unable to find) something that I would use on PCBs.
Usually vias under a metal pad on an IC are there to provide additional grounding or heatsinking to the copper. If you've got a via that should not connect to the component above it, I would recommend relocating it (instead of just tenting) because the tenting method does not guarantee that all boards will be electrically isolated. You might get a small hole in the mask which still allows an electrical connection with the component above.