Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
@babel/plugin-transform-runtime: What It Does and When You Need It
The babel plugin transform runtime deduplicates Babel's injected helpers and keeps polyfills out of the global scope. Here is what it actually changes in your output, and when it earns its place.
rrule npm Package: Recurrence Rules, Health, and Pitfalls
The rrule npm package is the standard way to handle iCalendar recurrence rules in JavaScript — but it carries timezone traps, unbounded-expansion hazards, and a slow maintenance pulse worth knowing before you depend on it.
marked on npm: Security Review and Safe Usage
marked is a fast Markdown parser, but it does not sanitize output and older versions carried a ReDoS bug. Here is how to use marked npm without opening an XSS hole.
Is the got npm Package Safe? A Security Review of got for Node.js
got is a well-maintained HTTP client, but one redirect-handling CVE and its SSRF-prone defaults are worth knowing before you ship it. Here is the security review.
Securing Your Vue Project with eslint-plugin-vue
eslint-plugin-vue is the official linter for Vue single-file components. It is not a security scanner, but used well it removes whole classes of bugs that turn into vulnerabilities.
Is the npm Luxon Package Safe to Use? A Security Review
The npm Luxon package is actively maintained and safe for current use, with one notable historical ReDoS advisory to be aware of. Here is the security picture.
angular-oauth2-oidc: Secure OAuth2 and OIDC in Angular
angular-oauth2-oidc is the most widely used OAuth2 and OpenID Connect client for Angular apps. Here is how to wire it up with PKCE, validate tokens correctly, and avoid the config mistakes that leak sessions.
npm handlebars: A Security Review and Safe Usage Guide
The npm handlebars package is a widely used templating engine with a history of prototype pollution issues. Here is what to know before you depend on it and how to use it safely.
core-js on npm: Security Review and Safe Usage
A security and sustainability review of core-js on npm: the postinstall history, the maintainer funding crisis, and how to keep this near-universal dependency safe.
connected-react-router: A Security Guide for an Inactive Package
connected-react-router is popular but no longer actively maintained and has no official React 18 support. Here is the risk that creates and how to move off it safely.
react-syntax-highlighter: Rendering Code Safely in React
react-syntax-highlighter is the go-to library for showing code blocks in React apps. Here is how to use it and how to avoid the XSS traps around rendering untrusted code.
npm uninstall package: How to Safely Remove Dependencies
How the npm uninstall package command works, what it leaves behind, and how to confirm a removed dependency is actually gone from your tree and your risk surface.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.