Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
react-md-editor: Using @uiw/react-md-editor Securely
How to use react-md-editor safely: what @uiw/react-md-editor does, the XSS risk in markdown preview, and why rehype-sanitize is not optional for untrusted input.
Joi npm: A Security Review and Safe Usage Guide
The joi npm package is the widely used JavaScript schema validation library. Here is its maintenance status, the @hapi/joi migration, and how to use it safely.
The npm figlet Package: A Security Review and Safe Usage Guide
The npm figlet package turns text into ASCII art and is downloaded well over a million times a week. Here is what it does, how to use it, and how to treat even a small utility as part of your supply chain.
npm commander: Security Review and Safe Usage of the CLI Library
The npm commander package is one of the most-downloaded CLI frameworks for Node. Here is a security-focused review of the library and how to use it safely.
Webpack 5 Node Polyfills: node-polyfill-webpack-plugin Explained
node-polyfill-webpack-plugin restores the Node core shims webpack 5 removed. Before you install it, understand what you are re-adding to your bundle and why webpack removed it.
Is python-docx Safe? A Security Guide
python-docx reads and writes Word documents in Python. Here is what its security posture actually depends on, especially when you open files you did not create.
npm autoprefixer: Is It Safe, and How Should You Use It?
The npm autoprefixer package is a PostCSS plugin that adds vendor prefixes to your CSS based on Browserslist data. Here is how it works, why it is a build-time dependency, and how to keep it safe.
react-loader-spinner: A Security Guide
react-loader-spinner adds ready-made loading spinners to React apps. It is UI-only, so its security story is entirely about dependency hygiene and install-time provenance.
The moment npm Package in 2025: Security Review and Safe Usage
The moment npm package is in maintenance mode, not abandoned. Here is what that means for security, when it is fine to keep, and what to migrate to when it is not.
@babel/eslint-parser: A Security and Migration Guide
@babel/eslint-parser is the maintained ESLint parser for Babel-transformed JavaScript, replacing the deprecated babel-eslint. Here is why the rename happened and what it means for your toolchain.
Using the aws-amplify npm Package Safely: A Security Review
The aws-amplify npm package is a large, capable SDK that touches auth, storage, and API calls. Here is a practical security review of what to watch for and how to use it without widening your attack surface.
webpack-cli: What It Does and How to Keep It Secure
webpack-cli is the command-line front end to webpack, and as a build-time dependency it deserves the same supply-chain scrutiny as your runtime packages.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.