Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
Rendering Markdown Securely in React Native with react-native-markdown-display
react-native-markdown-display is the maintained way to render Markdown in React Native, but rendering untrusted Markdown safely takes more than dropping in the component. Here is the security guide.
TinyMCE npm Security: XSS History and Safe Configuration
The tinymce npm package is a capable rich-text editor with a long history of XSS advisories. Keeping it current and configuring it defensively is what keeps it safe.
React Native Image Libraries: fast-image, slider-box, crop-picker Reviewed
react-native-image-slider-box, fast-image, and image-crop-picker solve real UI problems, but their maintenance status and native code deserve a hard look before you ship them.
Puppeteer on npm: A Security Review and Safe Usage Guide
puppeteer npm installs a library that drives a real headless Chrome. That power brings real risks — install scripts, SSRF, and a browser-sized attack surface. Here is how to use it safely.
tough-cookie npm: Security Review and Safe Usage
A security review of the tough-cookie npm package, including the CVE-2023-26136 prototype pollution flaw, the version that fixes it, and how to use it safely.
isomorphic-fetch: Security Review and Modern Alternatives
isomorphic-fetch has not shipped a release since 2020, yet thousands of projects still install it. What that means for your security posture, and what to use instead.
angular-auth-oidc-client: A Security-Focused Guide to Angular OIDC
angular-auth-oidc-client is a certified Angular library for OpenID Connect and OAuth2. Here is how to use it and how to configure it securely.
msw (npm): Mock Service Worker Without Leaking Mocks Into Production
The msw npm package is a superb API mocking tool, and its main security risk is operational: shipping a service worker or a mock server into production.
Is turndown on npm Safe? A Security Review
turndown converts HTML to Markdown with no known CVEs, but the real risk is what you do with its input and output. Here is how to use it safely.
pako on npm: Security Review and Safe Usage of the zlib Port
pako is a fast JavaScript port of zlib used for gzip and deflate in the browser and Node. Here is its security profile and how to use it safely on untrusted compressed input.
react-native-walkthrough-tooltip: Security and Maintenance
react-native-walkthrough-tooltip is popular but inactively maintained. Here is how to assess its risk, decide whether to keep it, and manage aging RN dependencies.
npm-force-resolutions: Security Review and Safe Usage
npm-force-resolutions pins vulnerable transitive dependencies to safe versions on older npm. Here is how it works, its risks, and why native npm overrides now beat it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.