Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
react-native-android-location-enabler: Safe Usage and Security Notes
The react-native-android-location-enabler package shows the native Android dialog that asks users to turn on location services. Here is how to use it correctly and the privacy practices that go with it.
Zod on npm: A Security Review and Safe Usage Guide
Zod is a well-maintained TypeScript validation library that is itself a security asset, if you put it at your trust boundaries. Here is a review and how to use it right.
image-size npm Package: Vulnerability History and Safe Usage
The image-size npm package has shipped several infinite-loop denial-of-service bugs in 2025. Here is what happened, which versions are affected, and how to use it safely.
npm run dev: What It Does and How to Run It Safely
npm run dev starts your project's development server via a script in package.json. Here is what actually happens under the hood and the security risks worth knowing.
React Native Cookies: Managing and Securing Session Cookies
A guide to react-native-cookies for reading and writing HTTP cookies in React Native apps, the platform gotchas, and how to keep session cookies secure.
Is the exceljs npm Package Safe? A Security Review
The exceljs npm package is a maintained, popular library for reading and writing Excel files, and it is a reasonable choice, but parsing untrusted spreadsheets carries real risk. Here is the review.
eslint-plugin-react-refresh: What It Does and Why It Matters
A guide to eslint-plugin-react-refresh: what the only-export-components rule enforces, how it relates to the react-refresh webpack plugin, and its security relevance.
Is @vitejs/plugin-react Safe? A Security Review
@vitejs/plugin-react is a build-time dev dependency, so its security story is mostly about supply chain trust and keeping it current rather than runtime exploits.
react-native-compressor: Security and Trust Considerations for Media Compression
react-native-compressor shrinks images, video, and audio on-device before upload. Here is how to vet it, its native footprint, and where the real risks are.
Is the jsPDF npm Package Safe? A Security Review
The jsPDF npm package is widely used for client-side PDF generation, but recent path traversal and ReDoS advisories mean the version you pin matters. Here is what to check.
Angular Compiler Security: What @angular/compiler-cli Handles and How to Keep It Safe
The Angular compiler is more than a build step — it enforces your template sanitization contract, and a 2025 XSS bug proved that assumption can break.
pdf-lib npm: A Security Review and Safe Usage Guide
pdf-lib is a popular pure-JavaScript library for creating and editing PDFs, with no known direct vulnerabilities but an inactive maintenance status worth planning around.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.