Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
pdfmake npm: A Security Review and Safe Usage Guide
pdfmake is a popular client and server PDF generator, but its dependency chain and server-side usage carry real risks. Here is a practical security review.
Sentry React: A Security Guide
Sentry React gives you error and performance monitoring for React apps, but the SDK also collects data that can leak secrets if you misconfigure it. Here is how to run it safely.
What Is react-server-dom-webpack? A Security Guide
react-server-dom-webpack is the low-level React Server Components binding meta-frameworks build on. Here is what it does and where the security risks actually live.
react-select-async-paginate: A Security Guide
react-select-async-paginate is a thin wrapper over react-select that loads dropdown options page by page. Here is how to use it without inheriting supply chain or data-handling risk.
@angular-eslint/builder: What It Is and How to Use It Safely
The @angular-eslint/builder package wires ESLint into the Angular CLI so you can run ng lint. Here's how it fits your build and where the supply-chain risk actually lives.
spring-context: The Dependency at the Heart of Spring (and Its CVEs)
spring-context is the artifact that gives you Spring's ApplicationContext, and it drags four more Spring modules into your build. Here is what it does, what it pulls in, and the CVEs that have hit it.
Nodemailer npm: A Security Review and Safe Usage Guide
Nodemailer is the default way to send email from Node.js. It is well maintained, but email is a classic injection surface. Here is a security review and how to use it safely.
Is npm body-parser Safe? A Security Review and Safe-Usage Guide
A practical look at npm body-parser, the CVE-2024-45590 denial-of-service issue, and how to configure the middleware so it does not become a liability in production.
FileSaver.js (file-saver): Package Review and Download Security
The file saver npm package still powers client-side downloads in millions of builds, but it has not shipped a release since 2020. Here is what that means for your dependency tree.
npm rollup: A Security Review and Safe Usage Guide
A practical look at what installing rollup from npm means for your supply chain, the DOM clobbering XSS bug you should know about, and how to pin a safe version.
How Safe Is the npm pino Logger? A Security Review
The npm pino logger is one of the fastest and best-maintained logging libraries for Node.js, and it is safe for production when you configure redaction and transports carefully.
How to Use the express-validator npm Package Safely
A security-focused review of the express-validator npm package: what it protects you from, what it does not, and how to configure it so bad input never reaches your handlers.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.