Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
isomorphic-fetch: Security Review and Modern Alternatives
isomorphic-fetch has not shipped a release since 2020, yet thousands of projects still install it. What that means for your security posture, and what to use instead.
angular-auth-oidc-client: A Security-Focused Guide to Angular OIDC
angular-auth-oidc-client is a certified Angular library for OpenID Connect and OAuth2. Here is how to use it and how to configure it securely.
msw (npm): Mock Service Worker Without Leaking Mocks Into Production
The msw npm package is a superb API mocking tool, and its main security risk is operational: shipping a service worker or a mock server into production.
Is turndown on npm Safe? A Security Review
turndown converts HTML to Markdown with no known CVEs, but the real risk is what you do with its input and output. Here is how to use it safely.
pako on npm: Security Review and Safe Usage of the zlib Port
pako is a fast JavaScript port of zlib used for gzip and deflate in the browser and Node. Here is its security profile and how to use it safely on untrusted compressed input.
react-native-walkthrough-tooltip: Security and Maintenance
react-native-walkthrough-tooltip is popular but inactively maintained. Here is how to assess its risk, decide whether to keep it, and manage aging RN dependencies.
Is the npm xlsx Package Safe? A Security Review
A security review of the npm xlsx (SheetJS) package: its prototype pollution and ReDoS CVEs, the npm-versus-CDN patch gap, and how to install it safely.
npm-force-resolutions: Security Review and Safe Usage
npm-force-resolutions pins vulnerable transitive dependencies to safe versions on older npm. Here is how it works, its risks, and why native npm overrides now beat it.
npm pack: How to Publish Without Leaking Secrets
npm pack builds the exact tarball that would be published to the registry. Using it before every publish is the simplest way to avoid shipping secrets.
react-oidc-context: A Security Guide
react-oidc-context wraps oidc-client-ts in React hooks for SPA authentication. Here is how to wire it up without leaking tokens or trusting the wrong callback.
@babel/plugin-proposal-class-properties: Security and Migration Guide
This Babel plugin is deprecated, not vulnerable. The real risk is supply chain hygiene: depending on an unmaintained package when the standard replacement is a one-line swap.
Is react-native-background-upload Safe to Ship?
react-native-background-upload moves files while your app is backgrounded, which is exactly why its security depends on how you handle URLs, tokens, and native permissions.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.