Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
npm crypto-js: A Security Review and Safe Usage Guide
The npm crypto-js library is widely used but has a documented cryptographic weakness before 4.2.0. Here is what to check and how to use it safely.
npm react-scripts: A Security Review and Safe Usage Guide
react-scripts powers Create React App, but CRA is now deprecated and react-scripts carries a stack of aging transitive dependencies. Here is how to handle it safely.
React Bootstrap Icons: Adding Icons Without Adding Risk
React Bootstrap Icons is a convenient SVG icon set for React apps. Here is how to use it and how to keep the dependency from becoming a supply-chain liability.
react-signature-canvas: A Security and Maintenance Review
A security review of react-signature-canvas: what the component does, its inactive maintenance status, the XSS surface to watch, and how to use it safely.
react-query (TanStack Query): Package Health and Data-Fetching Safety
The npm react-query package froze at v3.39.3 when the project moved to @tanstack/react-query. Here is how to tell which one you are running, and how to keep server-state caching from leaking data.
react-native-modal-datetime-picker: Security and Maintenance Guide
The react-native-modal-datetime-picker package is popular and convenient, but its maintenance status and transitive dependencies deserve a look before you commit to it.
Is supertest npm Safe to Use? A Security Review for Node Testing
A security-minded review of supertest npm, the SuperAgent-driven HTTP testing library: where it fits, what its dependency surface looks like, and how to keep test code from leaking into production risk.
Is the Busboy npm Package Safe? A Security Review
The busboy npm package parses multipart form data in Node.js. Here is its current security status, the dicer history that once bit it, and how to use it safely.
Is workbox-webpack-plugin Safe? A Security Guide
workbox-webpack-plugin generates service workers for your PWA at build time. Here is what its security profile looks like and how to keep the caching layer it creates from becoming a liability.
react-native-webview Security: Hardening WebViews in Mobile Apps
The react-native-webview component gives your app a browser inside the app, and that power is exactly why it needs careful configuration to avoid opening a hole in your mobile security.
react-native-app-auth: Secure OAuth and OpenID Connect for React Native
react-native-app-auth bridges the native AppAuth SDKs so your React Native app gets PKCE and RFC 8252 flows for free. Here is how to wire it up safely, including Azure AD.
Is the npm mysql Package Safe? A Security Review
A security-focused look at the npm mysql driver: SQL injection risks, prepared statements, connection handling, and why most teams should move to mysql2.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.