Open Source
In-depth guides and analysis on open source from the Safeguard engineering team.
252 articles
The npm figlet Package: A Security Review and Safe Usage Guide
The npm figlet package turns text into ASCII art and is downloaded well over a million times a week. Here is what it does, how to use it, and how to treat even a small utility as part of your supply chain.
Webpack 5 Node Polyfills: node-polyfill-webpack-plugin Explained
node-polyfill-webpack-plugin restores the Node core shims webpack 5 removed. Before you install it, understand what you are re-adding to your bundle and why webpack removed it.
Is python-docx Safe? A Security Guide
python-docx reads and writes Word documents in Python. Here is what its security posture actually depends on, especially when you open files you did not create.
npm autoprefixer: Is It Safe, and How Should You Use It?
The npm autoprefixer package is a PostCSS plugin that adds vendor prefixes to your CSS based on Browserslist data. Here is how it works, why it is a build-time dependency, and how to keep it safe.
react-loader-spinner: A Security Guide
react-loader-spinner adds ready-made loading spinners to React apps. It is UI-only, so its security story is entirely about dependency hygiene and install-time provenance.
The moment npm Package in 2025: Security Review and Safe Usage
The moment npm package is in maintenance mode, not abandoned. Here is what that means for security, when it is fine to keep, and what to migrate to when it is not.
@babel/eslint-parser: A Security and Migration Guide
@babel/eslint-parser is the maintained ESLint parser for Babel-transformed JavaScript, replacing the deprecated babel-eslint. Here is why the rename happened and what it means for your toolchain.
Using the aws-amplify npm Package Safely: A Security Review
The aws-amplify npm package is a large, capable SDK that touches auth, storage, and API calls. Here is a practical security review of what to watch for and how to use it without widening your attack surface.
webpack-cli: What It Does and How to Keep It Secure
webpack-cli is the command-line front end to webpack, and as a build-time dependency it deserves the same supply-chain scrutiny as your runtime packages.
react-native-version-check: Prompting App Updates the Safe Way
react-native-version-check compares the installed app version against the store listing so you can prompt users to update. Here is how to wire it up and its security tradeoffs.
qrcode.react Security: Safe QR Code Rendering in React
A security guide to the qrcode.react library, the risks of encoding untrusted data into QR codes, and how to render them safely in a React app.
react-native-vision-camera: A Security Guide to Camera Access
react-native-vision-camera is the go-to camera library for React Native. Here is how to handle permissions, frame data, and captured media without leaking user privacy.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.