Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
Is react-native-device-info Safe? A Security Guide
react-native-device-info is one of the most-used device fingerprinting libraries in React Native. Here is how to use it without leaking data or tripping privacy reviews.
React File Viewer: Is It Safe, and What Are the Alternatives?
react-file-viewer still gets thousands of weekly downloads despite going years without an update. Here is what the package does, the risks of a dormant dependency, and how to view files more safely.
node-fetch: Vulnerability History and the Native fetch Upgrade Path
The npm node-fetch package served a decade of HTTP requests and picked up two notable CVEs along the way. Here is its vulnerability history and how to move to native fetch.
undici npm: Security Review and Safe Usage
The undici npm package is Node.js's modern HTTP client and the engine behind the built-in fetch. Here is a review of its security history and how to keep npm undici patched.
react-number-format: A Security Guide for Safe Input Handling
react-number-format is a popular library for formatting numeric and masked inputs. Here is how to use it without opening XSS or validation gaps.
@microsoft/fetch-event-source: Robust SSE Streams in the Browser
The fetch event source library fixes everything the native EventSource API refuses to do: POST bodies, auth headers, and retry logic you actually control.
@angular-builders/jest: Setup and Dependency Security
@angular-builders/jest lets you run ng test with Jest instead of Karma. Here is how it works, the version-alignment rule that trips teams up, and how to keep its dependency tree secure.
serverless-webpack: Secure Bundling for Lambda Functions
serverless-webpack bundles your Lambda handlers with Webpack so each function ships only the code it needs. Here is how it works and the supply chain risks to watch when you adopt it.
Using EJS on npm Safely: CVE-2022-29078 and Beyond
The ejs npm package is a capable template engine that has also been the subject of a serious RCE advisory. Here is how to use it without opening that door.
react-native-asset: A Security Guide to Linking Assets
react-native-asset links fonts, sound files, and other assets into iOS and Android builds. Here is how it works and the supply-chain hygiene it deserves.
core-js 2.6.12: Vulnerabilities, EOL Status, and Upgrading to v3
Searching for core-js 2.6.12 vulnerabilities turns up no CVEs — the finding is the abandoned v2 line itself. What the deprecation actually means and how to migrate to core-js 3 cleanly.
npm dd-trace: Security Review and Safe Usage
The npm dd-trace package is Datadog's Node.js APM tracer. It runs deep in your process, so here is an honest look at its security posture and how to deploy it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.