Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
netty-handler: TLS in Netty and Keeping It Patched
netty-handler is where Netty's TLS lives, which makes it the module scanners flag most. What SslHandler actually does, the hostname-verification gotcha, and the patch cadence to keep.
react-native-blob-util: A Security Guide to Safe File and Blob Handling
react-native-blob-util is the maintained successor to rn-fetch-blob. Here is what it does, why the migration matters for security, and how to handle files safely.
Is body-parser Safe to Use? A Security Review of the npm Package
npm body-parser is Express middleware for reading request bodies, and it is safe when kept current. Here is the CVE-2024-45590 denial-of-service issue and how to configure it defensively.
Is Formik on npm Safe? A Security Review
Formik is a widely used React form library. Here is an honest look at its security history, dependency risk, and how to use it safely.
Is the npm express Package Safe? A Security Review
The npm express package is the most widely used Node.js web framework, and it is safe to run today if you stay on a maintained version and watch its small dependencies. Here is the security picture.
jsonwebtoken npm: Security Review and Safe Usage
The jsonwebtoken npm package signs and verifies JWTs for countless Node apps, and versions at or below 8.5.1 carry serious verification flaws. Here is how to use npm jsonwebtoken safely.
broadcast-channel npm Package: Health, Security, and Alternatives
A practitioner review of the broadcast-channel npm package: maintenance health, how its storage fallbacks work, the security boundaries of cross-tab messaging, and when the native API is enough.
Is uglifyjs-webpack-plugin Safe to Use in 2025? What to Migrate To
uglifyjs-webpack-plugin is deprecated and built on the unmaintained uglify-es. Here is why you should migrate to terser-webpack-plugin and how to do it cleanly.
papaparse npm: Security Review and Best Practices
PapaParse is the go-to CSV parser for JavaScript, but older versions carry a ReDoS flaw. Here is a security review and how to use it safely on untrusted files.
babel-core Security: Known CVEs and How to Stay Patched
babel-core is safe when current, but its dependency chain has carried a code-execution CVE and a ReDoS issue. Here is what to patch and why re-compiling matters.
uuid npm: Security Review and Safe Usage Guide
The uuid npm package is one of the most-installed libraries in the JavaScript ecosystem. Here is an honest look at its security posture and how to use it correctly.
Vetting React Native npm Packages: pager-view, paper, video, config
Before you add react-native-pager-view npm installs to a mobile app, run the same vetting you would for backend code. Here is a practical checklist using four popular packages as case studies.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.