Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
spring-context: The Dependency at the Heart of Spring (and Its CVEs)
spring-context is the artifact that gives you Spring's ApplicationContext, and it drags four more Spring modules into your build. Here is what it does, what it pulls in, and the CVEs that have hit it.
Is the Cheerio npm Package Safe? A Security Review
A practitioner's look at the cheerio npm package: what it does, where its real security risk lives, and how to use it safely in production scrapers and parsers.
Execa on npm: A Security Review and Safe Usage Guide
Execa is one of the most popular ways to run child processes in Node.js. Here is how to use the execa npm package without opening a command-injection hole.
How to Use the express-validator npm Package Safely
A security-focused review of the express-validator npm package: what it protects you from, what it does not, and how to configure it so bad input never reaches your handlers.
How Safe Is the npm pino Logger? A Security Review
The npm pino logger is one of the fastest and best-maintained logging libraries for Node.js, and it is safe for production when you configure redaction and transports carefully.
npm rollup: A Security Review and Safe Usage Guide
A practical look at what installing rollup from npm means for your supply chain, the DOM clobbering XSS bug you should know about, and how to pin a safe version.
node-forge Vulnerabilities: What Happened and What to Use Now
node-forge shipped signature-forgery and prototype-pollution fixes over the years, and its release cadence has gone quiet. Here is what each node-forge vulnerability meant and what to reach for today.
zxcvbn npm: Is the Password Strength Library Still Safe to Use?
The zxcvbn npm package still works well for password strength estimation, but the original Dropbox library is effectively unmaintained. Here is what that means and what to use instead.
Is react-json-view Safe to Use? A Security Guide
The original react-json-view package is popular but unmaintained. Here is what that means for your app's security and which fork to move to.
class-validator: Security, Health, and Safe Usage in Production
class-validator powers input validation in most NestJS apps, but its defaults burned teams once before. Here is its real security history and how to configure it safely.
rn-fetch-blob: Maintenance Status, Risks, and Alternatives
The rn-fetch-blob npm package hasn't shipped a release since 2020. Here's what that means for React Native apps still depending on it, and how to migrate to react-native-blob-util.
Is swagger-ui-react Safe? A Security Guide for React API Docs
swagger-ui-react has no known direct CVEs, but its real risk lives in a deep dependency tree. Here is how to embed it without inheriting a transitive XSS.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.